FreeRTOS vulnerabilities by version: kernel and FreeRTOS+TCP

How many CVEs does the NVD list for my FreeRTOS version?

Counted are CVEs whose NVD configuration lists the version as vulnerable, queried on 23 October 2026 without rejected entries. The NVD lists the kernel as an operating system under cpe:2.3:o:amazon:freertos. Anyone who queries only cpe:2.3:a:amazon:freertos finds not a single CVE for 10.3.1. In brackets: which vendor package ships this version.

The number is a version range. From 10.4.3 on, every vulnerability counted affects only builds with an MPU port or TrustZone.

Is FreeRTOS before 10.4.3 affected?

Two integer overflows in the queue and the stream buffer and a missing bounds check in the heap, all with CVSS 9.8 and all fixed in version 10.4.3 of 14 December 2020. They sit in queue, stream buffer and heap and do not depend on the port. The change log names no CVE number. It says “Changes to improve robustness and consistency for buffer allocation in the heap, queue and stream buffer”. Anyone who reads only the change log can easily miss them.

Does a vulnerability in the MPU or TrustZone port affect me?

These vulnerabilities affect only builds with an MPU port, such as ARM_CM4_MPU or an ARMv8-M port with configENABLE_MPU set to 1, or with the secure side of TrustZone. A build without an MPU port does not have this attack surface. It also has no separation between privileged and unprivileged tasks. Scores marked (CNA) come from Amazon as the CNA, because the NVD has not scored them itself.

Which FreeRTOS version do STM32Cube, the NXP SDK and ESP-IDF ship?

Many devices get FreeRTOS through the chip vendor's SDK. Read from task.h at the published tags, as of 23 October 2026. None of the chip vendor packages ships 11.3.1 or newer. STM32CubeF4 and STM32CubeF7 ship versions with the three CVSS 9.8 vulnerabilities.

Two traps when reading the version. FreeRTOS 10.2.1 carries the text “V10.2.0” in the macro tskKERNEL_VERSION_NUMBER, already in Amazon's original; the file header says 10.2.1. And STM32CubeH7 v1.13.0: the release notes and the SBOM name FreeRTOS V10.6.2, but the submodule at Git tag v1.13.0 points to V10.3.1. Only the master branch points to V10.6.2, since 27 March 2026.

$ curl -s https://raw.githubusercontent.com/FreeRTOS/FreeRTOS-Kernel/V10.2.1/FreeRTOS/Source/include/task.h  \
| grep -n -E "tskKERNEL_VERSION_NUMBER|FreeRTOS Kernel V"

2: * FreeRTOS Kernel V10.2.1
46:#define tskKERNEL_VERSION_NUMBER "V10.2.0"

Which CVEs does FreeRTOS+TCP have?

The TCP/IP stack has a version number of its own, separate from the kernel, and CVEs of its own. On 29 April 2026, 4.4.1 and 4.2.6 came out with the same fixes, on 16 October 2026 only 4.4.2. Seven of the eleven vulnerabilities since 2025 sit in the IPv6 part: router advertisement, DHCPv6, ICMPv6, UDP over IPv6.

Where is the FreeRTOS version in my firmware?

In the source code the kernel version is in task.h, macro tskKERNEL_VERSION_NUMBER, and in the file header. In the build it is wherever the compiler writes it: in the path of the source files, in the debug information or as a string the application prints. In the public Keil example it is in the path.

1. 1

   Determine the version

   task.h in the project or, in the build, the path, the debug information or a string. For 10.2.1 read the file header, the macro says 10.2.0.

2. 2

   Establish the origin

   Amazon's original, or a copy from STM32Cube, the NXP SDK or ESP-IDF. For STM32Cube from GitHub, check the submodule state, not only the release notes.

3. 3

   Determine the port

   does the build use an MPU port, the secure side of TrustZone or the Cortex-R82 port? Every kernel vulnerability from 10.4.3 on depends on it.

4. 4

   Check FreeRTOS+TCP separately

   its own version, its own CVEs.

5. 5

   Query the NVD

   virtualMatchString=cpe:2.3:o:amazon:freertos:<version> for the kernel, cpe:2.3:a:amazon:freertos-plus-tcp:<version> for the stack. Also read the security advisories on GitHub, which name new vulnerabilities before the NVD does.

$ strings -a -t x ble_freertos_amota.axf | grep -m1 -F "FreeRTOSv10.1.1"

  1fe9c ../../../../../third_party/FreeRTOSv10.1.1/Source/timers.c

$ nm ble_freertos_amota.axf | grep -E "xQueueGenericCreate|pvPortMalloc"

0001bfb5T pvPortMalloc0001fe85T xQueueGenericCreate

What can I do?

1. 1

   Kernel before 10.4.3: move to a current version. The three CVSS 9.8 vulnerabilities do not depend on the port.

2. 2

   Kernel with an MPU port or TrustZone: move to 11.3.1, with the Cortex-R82 port to 11.3.2. If you need an LTS release: FreeRTOS LTS 202604.01 contains kernel V11.3.1.

3. 3

   Without an MPU port: configENABLE_MPU defaults to 0 in FreeRTOS.h. You select the ARMv7-M MPU ports through the port directory, for example portable/GCC/ARM_CM4_MPU. A build that compiles none of them does not carry the MPU vulnerabilities in the image.

4. 4

   Queue sets: CVE-2026-77237 requires configUSE_QUEUE_SETS set to 1. The default in FreeRTOS.h is 0.

5. 5

   FreeRTOS+TCP: move to 4.4.2. Until then, the options in FreeRTOSIPConfig.h decide: ipconfigUSE_IPv6 and ipconfigUSE_RA default to on, ipconfigUSE_DHCPv6, ipconfigUSE_LLMNR, ipconfigUSE_MDNS and ipconfigSUPPORT_OUTGOING_PINGS to off. CVE-2026-7424 requires DHCPv6, CVE-2026-7423 outgoing pings.

6. 6

   Check the CISA KEV catalogue for actively exploited vulnerabilities.

Can this run automatically?

LegacyMind detects FreeRTOS in the ELF, AXF or OUT of your build, reads the version from Keil and GNU Arm builds and matches it against the public vulnerability sources, with a note on whether a vulnerability is actively exploited. It also checks whether the build uses the MPU port and creates tasks without privileges.