CVE-2026-77236: Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel
Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRTOS-Kernelto a version that resolves this vulnerability.Fixed in 11.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access and low privileges. An attacker must be able to invoke the affected secure context allocation path with an undersized stack size parameter.
What is the impact of a successful exploit?
A successful exploit can cause an out-of-bounds write that corrupts secure-world heap metadata. The reported impact includes integrity loss and high availability impact.
Which versions should be remediated?
FreeRTOS-Kernel versions before 11.3.1 are affected. Upgrade to version 11.3.1 or later.