# CVE-2026-109587: FreeRTOS-Kernel memory protection unit authorization bypass on Arm Cortex-R82

Source: https://junglewise.ai/threats/cve-2026-109587-amp-issue-with-freertos-kernel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109587 · Severity: high · CVSS 8.8 · Published 2026-10-16

FreeRTOS-Kernel is a real-time operating system for microcontrollers and small processors. Two memory protection vulnerabilities in the Arm Cortex-R82 port allow unprivileged tasks to read and write privileged kernel memory that should be protected, potentially enabling data theft or system compromise when memory protection is enabled.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [Amazon FreeRTOS Kernel](https://junglewise.ai/threats/technologies/freertos-kernel). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon).

## Quick answers

**Is CVE-2026-109587 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109587 being exploited in the wild.

**How severe is CVE-2026-109587?** High severity, with a CVSS score of 8.8, published 16 October 2026.

**Which products and versions are affected?** Amazon FreeRTOS Kernel V11.3.0, V11.3.1 (Arm Cortex-R82 with configENABLE_MPU=1).

**Is there a fix for CVE-2026-109587?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109587 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-109587?** Check whether you run Amazon AWS or Amazon FreeRTOS Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-109587 involves incorrect authorization enforcement where the MPU port fails to validate memory-region boundaries for buffers passed by unprivileged tasks to MPU system calls. CVE-2026-109588 involves numeric truncation in buffer-length validation that allows bypassing the buffer window check. Both affect only Arm Cortex-R82 builds with configENABLE_MPU=1; applications without FreeRTOS MPU are unaffected. An unprivileged task can exploit either to access kernel memory outside its assigned regions.

## Affected products

- Amazon FreeRTOS-Kernel V11.3.0, V11.3.1 (Arm Cortex-R82 with configENABLE_MPU=1)

## Identifiers

- CVE-2026-109587
- CVE-2026-109588

## Timeline

- 2026-10-16: disclosed

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)