Description
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.
CVSS 5.3EPSS 0.22100000000000003%Risque 0.54
Voir la source- Publication
- 2026-04-29 19:16:26
- Versions concernées
- <4.2.6,<4.4.1
- Type
- Micrologiciel
- Vecteur
- CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H