CVE-2026-7425: FreeRTOS-Plus-TCP IPv6 DoS Vulnerability

CVE-2026-7425 Overview

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smaller than the expected structure size. This out-of-bounds read vulnerability (CWE-125) can be exploited by attackers on the same network segment to crash vulnerable IoT devices and embedded systems running the affected TCP/IP stack.

Critical Impact
Adjacent network attackers can crash IoT devices and embedded systems by exploiting improper bounds checking in IPv6 Router Advertisement packet processing.

Affected Products

FreeRTOS-Plus-TCP versions prior to V4.2.6
FreeRTOS-Plus-TCP versions prior to V4.4.1
IoT and embedded devices using vulnerable FreeRTOS-Plus-TCP stack

Discovery Timeline

2026-04-29 - CVE-2026-7425 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7425

Vulnerability Analysis

The vulnerability exists in the IPv6 Router Advertisement (RA) parser within the FreeRTOS-Plus-TCP networking stack. When processing incoming Router Advertisement messages, the parser fails to properly validate the length field of the PREFIX_INFORMATION option before attempting to read the full option structure. This insufficient validation creates an out-of-bounds read condition when a maliciously crafted RA message contains a truncated option with a length value smaller than the expected PREFIX_INFORMATION structure size.

FreeRTOS-Plus-TCP is widely deployed in resource-constrained IoT devices and embedded systems, making this vulnerability particularly impactful in industrial control systems, smart home devices, and other networked embedded applications. The attack requires adjacent network access, meaning the attacker must be on the same network segment as the target device.

Root Cause

The root cause is improper input validation (CWE-125: Out-of-bounds Read) in the IPv6 Router Advertisement option parsing code. The parser reads the option length field from the incoming packet but does not verify that this length is sufficient to contain the expected PREFIX_INFORMATION data structure before accessing memory beyond the actual packet boundaries. This allows an attacker to trigger reads past the allocated buffer, causing undefined behavior that typically results in a device crash.

Attack Vector

This vulnerability requires adjacent network access, meaning an attacker must be positioned on the same local network segment as the target device. The attack is executed by crafting a malicious IPv6 Router Advertisement packet with a PREFIX_INFORMATION option that has an artificially small length field. When the vulnerable device processes this packet, it attempts to read the full expected structure size despite the truncated option, triggering an out-of-bounds memory read. No user interaction or authentication is required—simply being on the same network and sending the crafted packet is sufficient to crash the target device.

The attack mechanism involves:

The attacker sends a crafted IPv6 Router Advertisement packet to the target device
The RA packet contains a PREFIX_INFORMATION option with an invalid (truncated) length field
The vulnerable parser reads the length but fails to validate it against minimum expected size
When processing the option, the parser reads beyond the actual packet buffer
The out-of-bounds read triggers a crash or undefined behavior on the device

Detection Methods for CVE-2026-7425

Indicators of Compromise

Unexpected device reboots or crashes in IoT/embedded systems with no apparent cause
Anomalous IPv6 Router Advertisement packets on the network with malformed option lengths
Network traffic analysis showing RA messages with PREFIX_INFORMATION options smaller than 32 bytes
Device logs indicating memory access violations during IPv6 packet processing

Detection Strategies

Deploy network intrusion detection rules to identify IPv6 Router Advertisement packets with malformed option lengths
Monitor for repeated device crashes that correlate with IPv6 network activity
Implement packet capture and analysis at network boundaries to identify crafted RA messages
Use firmware integrity monitoring to detect devices in crash-reboot loops

Monitoring Recommendations

Enable verbose logging on network infrastructure to capture IPv6 RA traffic patterns
Configure alerts for device availability issues affecting systems running FreeRTOS-Plus-TCP
Implement network segmentation monitoring to detect unauthorized adjacent network access
Review SIEM logs for patterns of device failures correlated with network events

How to Mitigate CVE-2026-7425

Immediate Actions Required

Upgrade FreeRTOS-Plus-TCP to version V4.2.6 or V4.4.1 immediately
Implement network segmentation to limit adjacent network access to vulnerable devices
Consider disabling IPv6 on affected devices if not required for operations
Deploy network-level filtering to block malformed IPv6 Router Advertisement packets

Patch Information

The FreeRTOS project has released patched versions that address this vulnerability. Users should upgrade to FreeRTOS-Plus-TCP V4.2.6 or FreeRTOS-Plus-TCP V4.4.1 depending on their version branch. Additional details are available in the GitHub Security Advisory GHSA-gffr-xgjg-jh9j and the AWS Security Bulletin 2026-023.

Workarounds

Disable IPv6 functionality on affected devices where IPv4-only operation is acceptable
Implement network access controls to restrict which systems can send Router Advertisements
Deploy RA Guard on network switches to filter unauthorized Router Advertisement messages
Isolate vulnerable IoT devices on dedicated network segments with restricted access

bash

# Example: Disable IPv6 on Linux-based gateway to filter RAs before reaching IoT network
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1