Executive brief
FreeRTOS-Kernel is a real-time operating system widely used in embedded microcontroller and IoT applications. AWS disclosed four memory safety vulnerabilities affecting different configurations of FreeRTOS—including those with memory protection units, ARM TrustZone security extensions, and queue management features—that could allow attackers to corrupt memory or escalate privileges within affected embedded systems.
Technical details
AWS disclosed four distinct memory safety vulnerabilities in FreeRTOS-Kernel affecting different optional features. CVE-2026-77234 impacts versions ≥7.0.0 and ≤11.3.0 when the MPU is enabled with software timers; CVE-2026-77235 and CVE-2026-77236 affect versions ≥10.2.0 and ≤11.3.0 on ARM TrustZone-enabled ARMv8-M ports; CVE-2026-77237 affects versions ≥7.4.0 and ≤11.3.0 when queue sets are explicitly enabled (configUSE_QUEUE_SETS=1). Each vulnerability is specific to its configuration, meaning applications not using the affected feature set are not impacted. Specifics on the vulnerability class, root cause, or attack preconditions are not disclosed in the advisory. Patches are implied to be available but no explicit patch version guidance is provided in the available text.
Affected products
- AWS FreeRTOS-Kernel 7.0.0 to 11.3.0 (varies by CVE and configuration)
CVE identifiers
- CVE-2026-77235
- CVE-2026-77237
- CVE-2026-77234
- CVE-2026-77236
Timeline
- 2026-08-21: disclosed
- 2026-09-09: advisory