CVE-2025-11617

Buffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCP

State: Published
Severity: 5.3 Medium
Published: Oct 10, 2025
Updated: Oct 10, 2025
Reserved: Oct 10, 2025

Description

A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet with incorrect payload lengths in the packet header. This issue only affects applications using IPv6.

We recommend users upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N	AMZN
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L	AMZN

Weaknesses

CWE-126 Buffer Over-read

Affected Products

Product	Versions
FreeRTOS-Plus-TCPAWS	4.0.0 to before 4.3.4Affected

References

https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.4patchproduct
https://aws.amazon.com/security/security-bulletins/AWS-2025-023/vendor-advisory
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-wmjr-wm93-cvv2third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.