CVE-2026-77236 Overview
CVE-2026-77236 is an out-of-bounds write vulnerability in the FreeRTOS-Kernel affecting versions prior to 11.3.1. The flaw stems from missing minimum size validation during secure context allocation. Local users can supply an undersized stack size parameter to corrupt secure-world heap metadata. The issue is tracked under [CWE-787] and affects deployments that rely on ARM TrustZone secure-context separation. Amazon Web Services published guidance in AWS Security Bulletin 2026-086, and the FreeRTOS project issued GitHub Security Advisory GHSA-vq2f-9qj3-jj2m. Users should upgrade to FreeRTOS-Kernel version 11.3.1 or later.
Critical Impact
A local attacker with low privileges can corrupt secure-world heap metadata, undermining the integrity and availability of the secure context and any workloads relying on TrustZone isolation.
Affected Products
- Amazon FreeRTOS-Kernel versions prior to 11.3.1
- Embedded systems using FreeRTOS secure-context allocation on ARM TrustZone-M platforms
- Downstream distributions bundling vulnerable FreeRTOS-Kernel releases
Discovery Timeline
- 2026-08-21 - CVE-2026-77236 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-77236
Vulnerability Analysis
The vulnerability resides in the FreeRTOS-Kernel routine that allocates secure contexts for tasks executing across the ARM TrustZone-M boundary. When a task requests a secure context, the kernel allocates a stack in secure-world memory sized according to a caller-supplied parameter. The affected code paths do not enforce a minimum stack size prior to allocation. A local, low-privileged actor able to invoke the secure-context allocation API can pass an undersized value and trigger writes that fall outside the intended allocation bounds.
The primary consequence is corruption of secure-world heap metadata. Downstream effects include instability of the secure partition, disruption of security services running in the secure world, and integrity impact on both the secure context and the system control state that depends on it.
Root Cause
The root cause is missing input validation on the stack size parameter accepted by the secure-context allocation function. The kernel proceeds to compute allocation bookkeeping and write control structures based on an attacker-influenced size that can be smaller than the fixed layout requires. This produces an out-of-bounds write [CWE-787] into adjacent heap metadata.
Attack Vector
Exploitation requires local access with the ability to invoke the vulnerable secure-context allocation path from non-secure code. No user interaction is required. Because the corruption targets secure-world state, exploitation crosses a trust boundary and affects components that would normally be isolated from the non-secure caller. Refer to the FreeRTOS V11.3.1 Release notes for the specific code change enforcing minimum size validation.
No public proof-of-concept exploit is available at time of publication.
Detection Methods for CVE-2026-77236
Indicators of Compromise
- Unexpected resets, faults, or MemManage exceptions originating from the secure partition on TrustZone-M targets.
- Corruption or assertion failures in the FreeRTOS secure-side heap during task creation or context switch.
- Task creation calls specifying anomalously small ulSecureStackSize values compared to firmware baselines.
Detection Strategies
- Audit firmware source and binaries for the FreeRTOS-Kernel version string and confirm it is 11.3.1 or later.
- Instrument secure-side heap allocators to log allocation sizes and flag values below the platform minimum for secure contexts.
- Review integrations that expose secure-context creation to less-trusted callers and validate parameter constraints in wrappers.
Monitoring Recommendations
- Collect and centralize device fault telemetry to identify repeated secure-world exceptions across a device fleet.
- Track firmware software bill of materials (SBOM) entries for FreeRTOS-Kernel and alert on versions earlier than 11.3.1.
- Monitor build pipelines to prevent regressions to pre-11.3.1 kernel versions.
How to Mitigate CVE-2026-77236
Immediate Actions Required
- Upgrade all firmware images to FreeRTOS-Kernel 11.3.1 or later and redeploy to affected devices.
- Inventory embedded products and IoT fleets for use of FreeRTOS secure-context features on ARM TrustZone-M.
- Restrict which non-secure components are permitted to call secure-context allocation APIs.
Patch Information
The fix is included in FreeRTOS-Kernel 11.3.1, which adds minimum size validation to secure context allocation. See the FreeRTOS V11.3.1 Release and GitHub Security Advisory GHSA-vq2f-9qj3-jj2m for the authoritative remediation guidance. AWS customers should also review AWS Security Bulletin 2026-086.
Workarounds
- Where immediate upgrade is not feasible, wrap secure-context allocation calls with application-level checks that enforce a minimum stack size consistent with the target platform.
- Reduce exposure by limiting which tasks can create secure contexts and by validating all parameters passed from less-trusted components.
- Apply defense-in-depth by enabling ARM MPU or IDAU configurations that constrain non-secure access to secure allocation entry points.
# Configuration example: verify FreeRTOS-Kernel version in a build tree
grep -R "tskKERNEL_VERSION_NUMBER" ./FreeRTOS-Kernel/include/task.h
# Ensure the reported version is 11.3.1 or later before shipping firmware
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
