CVE-2026-7423 Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP

Medium 6.0 Published 29 Apr 2026 Updated 29 Apr 2026

An integer underflow in FreeRTOS-Plus-TCP allows adjacent attackers to cause device crashes via heap out-of-bounds reads when outgoing ping support is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-7423?

CVE-2026-7423 is a medium-severity vulnerability in AWS FreeRTOS-Plus-TCP, published on 29 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB.

To mitigate this issue, users should upgrade to the fixed version when available.

Weakness: CWE-191

Which versions are affected by CVE-2026-7423?

It affects 1 product.

Products include Amazon Freertos-Plus-Tcp.

How do I fix CVE-2026-7423?

No fix has been published for CVE-2026-7423 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-7423 being exploited?

There is no known exploitation of CVE-2026-7423 in the wild and no public exploit code.

Sources

Also known as GHSA-7r59-2pgv-9v2r.