CVE-2026-7426: Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before…
CVE-2026-7426 · Severity: high · CVSS 8.1 · Published 2026-04-29
Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow. Users processing IPv4 RA only are not impacted.
To mitigate this issue, users should upgrade to the fixed version when available.
No. Junglewise Threat Intelligence has no report of CVE-2026-7426 being exploited in the wild.
How severe is CVE-2026-7426?
High severity, with a CVSS score of 8.1, published 29 April 2026.
Which products and versions are affected?
Amazon Freertos-Plus-Tcp. The advisory does not name versions.
Is there a fix for CVE-2026-7426?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-7426?
Check whether you run Amazon Freertos-Plus-Tcp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.