# CVE-2026-77237: FreeRTOS-Kernel type confusion in xQueueAddToSet()

Source: https://junglewise.ai/threats/cve-2026-77237-freertos-kernel-type-confusion-in-xqueueaddtoset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77237 · Severity: medium · CVSS 6.5 · Published 2026-08-21

FreeRTOS-Kernel is a real-time operating system kernel used in embedded systems and IoT devices. A type confusion vulnerability in the xQueueAddToSet() function allows an unprivileged task running on systems with Memory Protection Unit (MPU) enabled to read privileged kernel memory by passing an ordinary queue instead of a queue set, potentially exposing sensitive system data.

Technologies: [Amazon Freertos](https://junglewise.ai/threats/technologies/freertos). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon).

## Quick answers

**Is CVE-2026-77237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77237 being exploited in the wild.

**How severe is CVE-2026-77237?** Medium severity, with a CVSS score of 6.5, published 21 August 2026.

**Which products and versions are affected?** FreeRTOS FreeRTOS-Kernel before 11.3.1.

**Is there a fix for CVE-2026-77237?** A patch was published on 2026-08-21: Fixed in FreeRTOS-Kernel v11.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77237 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-77237?** Check whether you run Amazon Freertos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a type confusion flaw in xQueueAddToSet() that fails to validate whether the object passed as a queue set is actually a queue set (identified by an item size of sizeof(Queue_t *)). An attacker-controlled unprivileged task on MPU-enabled ports with configUSE_QUEUE_SETS=1 can pass an ordinary queue, causing prvNotifyQueueSetContainer to copy item-size bytes from a single pointer on the stack, leading to unauthorized kernel memory disclosure. The attack requires local task execution privileges and specific kernel configuration but does not require administrative access. The vulnerability was fixed in FreeRTOS-Kernel version 11.3.1 by adding type validation that now returns pdFAIL when a non-queue-set object is passed.

## Affected products

- FreeRTOS FreeRTOS-Kernel before 11.3.1

## Timeline

- 2026-08-21: disclosed
- 2026-08-21: patched: Fixed in FreeRTOS-Kernel v11.3.1

## References

- [https://aws.amazon.com/security/security-bulletins/2026-086-aws/](https://aws.amazon.com/security/security-bulletins/2026-086-aws/)
- [https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1](https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1)

## Related threats

- [FreeRTOS-Kernel secure context allocation missing size validation](https://junglewise.ai/threats/cve-2026-77236-freertos-kernel-secure-context-allocation-missing-size-validation)
- [FreeRTOS-Kernel missing privilege verification in secure context cleanup](https://junglewise.ai/threats/cve-2026-77235-freertos-kernel-missing-privilege-verification-in-secure-context)
- [AWS FreeRTOS-Kernel memory safety issues](https://junglewise.ai/threats/cve-2026-77234-aws-freertos-kernel-memory-safety-issues)