# CVE-2026-109588: FreeRTOS-Kernel numeric truncation in MPU buffer authorization on Arm Cortex-R82

Source: https://junglewise.ai/threats/cve-2026-109588-numeric-truncation-of-the-buffer-length-in-the-mpu-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109588 · Severity: high · CVSS 8.8 · Published 2026-10-16

FreeRTOS-Kernel is a real-time operating system for embedded devices and microcontrollers. On Arm Cortex-R82 processors with memory protection enabled, a numeric truncation flaw in the buffer length check allows unprivileged tasks to read or write kernel memory beyond the intended boundaries via stream buffer system calls, potentially leading to privilege escalation or data exposure.

Technologies: [Amazon FreeRTOS Kernel](https://junglewise.ai/threats/technologies/freertos-kernel). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon).

## Quick answers

**Is CVE-2026-109588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109588 being exploited in the wild.

**How severe is CVE-2026-109588?** High severity, with a CVSS score of 8.8, published 16 October 2026.

**Which products and versions are affected?** Amazon FreeRTOS Kernel V11.3.0, V11.3.1.

**Is there a fix for CVE-2026-109588?** Yes: fixed in V11.3.2. Until then: Disable the FreeRTOS MPU feature on Arm Cortex-R82 builds (set configENABLE_MPU=0) if not required for your application, which eliminates the risk. Upgrading to version V11.3.2 or later is the recommended remediation when MPU protection is necessary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109588 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-109588?** Check whether you run Amazon FreeRTOS Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in V11.3.2

Disable the FreeRTOS MPU feature on Arm Cortex-R82 builds (set configENABLE_MPU=0) if not required for your application, which eliminates the risk. Upgrading to version V11.3.2 or later is the recommended remediation when MPU protection is necessary.

## Technical details

A numeric truncation vulnerability in the MPU buffer authorization check on Arm Cortex-R82 (Armv8-R AArch64) fails to account for the full buffer length passed to stream buffer system calls. An unprivileged task on MPU-enabled builds (configENABLE_MPU=1) can exploit this to access privileged kernel memory outside validated regions. This is a local attack vector requiring the MPU port and MPU feature to be enabled; applications without FreeRTOS MPU are unaffected.

## Affected products

- Amazon FreeRTOS-Kernel V11.3.0, V11.3.1

## Timeline

- 2026-10-16: disclosed: CVE-2026-109588 published

## References

- [https://aws.amazon.com/security/security-bulletins/2026-138-aws/](https://aws.amazon.com/security/security-bulletins/2026-138-aws/)
- [https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.2](https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.2)

## Related threats

- [Amazon FreeRTOS-Kernel type validation bypass in xQueueSelectFromSet](https://junglewise.ai/threats/cve-2026-119086-missing-type-validation-in-xqueueselectfromset-in-freertos)
- [FreeRTOS-Kernel memory protection unit authorization bypass on Arm Cortex-R82](https://junglewise.ai/threats/cve-2026-109587-amp-issue-with-freertos-kernel)
- [FreeRTOS-Kernel missing privilege verification in secure context cleanup](https://junglewise.ai/threats/cve-2026-77235-freertos-kernel-missing-privilege-verification-in-secure-context)
- [AWS FreeRTOS-Kernel memory safety issues](https://junglewise.ai/threats/cve-2026-77234-aws-freertos-kernel-memory-safety-issues)