CVE-2026-77237

Executive Summary

CVE-2026-77237 is a high-severity out-of-bounds read vulnerability (CWE-125) affecting the FreeRTOS-Kernel prior to version 11.3.1, specifically in the xQueueAddToSet() function when configUSE_QUEUE_SETS=1 is enabled on MPU-enabled ports. The flaw allows an unprivileged task to read privileged kernel memory, potentially exposing sensitive data such as cryptographic keys, authentication tokens, or other critical system state. With a CVSS score of 6.5, the vulnerability requires local access and low privileges but has a changed security scope, meaning the compromised component impacts resources beyond its original authorization boundary. Any embedded system built on FreeRTOS 11.3.0 or earlier with MPU support and queue-set functionality enabled is affected. No public exploit code has been identified to date, and the patch status remains unconfirmed across tracked sources, although the vendor advisory indicates remediation is available in version 11.3.1.

Technical Analysis

This vulnerability resides in the FreeRTOS kernel's message queue set mechanism, a higher-level abstraction that allows tasks and ISRs to block on multiple queues simultaneously. The affected function, xQueueAddToSet(), is responsible for associating a queue with a queue set. According to the NVD description, the flaw stems from a missing queue-set type validation — the function fails to properly verify that the type associated with the queue being added to a queue set is of the expected, permitted kind before processing it.

On MPU-enabled FreeRTOS ports, kernel objects are partitioned into privileged and unprivileged memory regions. The Memory Protection Unit enforces strict access boundaries so that user tasks cannot read or write to kernel-private structures. The vulnerability allows the xQueueAddToSet() function to be called with a queue object whose internal type metadata has not been validated against the expected queue-set membership requirements. Without this type check, a malformed or spoofed queue handle can cause the function to dereference memory outside the bounds of the legitimate queue object — an out-of-bounds read.

Given that this is an information-disclosure issue (CVE-2026-77237 carries a Confidentiality impact of HIGH and Integrity/ Availability impacts of NONE), the root cause is almost certainly a missing bounds/type assertion prior to a memory read operation. The xQueueAddToSet() implementation likely reads from a structure at a fixed offset to determine the object's type. If an attacker can influence which object pointer is passed (e.g., by casting a different kernel object to a queue handle), the subsequent read may cross into adjacent kernel memory, leaking bytes to the calling task.

The CVSS vector details — AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N — confirm the following:

• Attack Vector (Local): The attacker must already have code execution within a FreeRTOS task running on the device. This is not remotely exploitable over a network.
• Privileges Required (Low): The attacker needs only an unprivileged task context; no kernel-level privileges are required initially.
• Scope (Changed): The compromised unprivileged task is able to read data from the privileged kernel memory region — a different security authority.
• Confidentiality (High): Full disclosure of privileged kernel memory contents is possible.
• Integrity (NONE), Availability (NONE): The flaw does not permit modification of memory or denial-of-service.

No further technical details — such as specific structure layouts, architecture-specific register semantics, or proof-of-concept code — are available from the public advisory. The severity of impact depends heavily on what data resides in kernel memory adjacent to queue-set objects: TCBs (Task Control Blocks), heap metadata, scheduler state, or inter-task message buffers.

Exploitation Scenarios

Since no public proof-of-concept exists for CVE-2026-77237, the following attack chain is inferred from the vulnerability class (out-of-bounds read via missing type validation in a kernel API function) and the specific function name referenced in the NVD description.

Step 1 — Initial Compromise (Reconnaissance/Target Identification): The attacker must first achieve unprivileged code execution inside a FreeRTOS task. Attack vectors include: exploiting a separate memory-corruption bug in an application task, leveraging a malicious firmware update that includes attacker-controlled code in a user task, or compromising a network-facing task that processes untrusted input (e.g., a TCP/IP stack task). On embedded devices such as IoT sensors, smart meters, or industrial controllers, typical entry points include malformed network packets, crafted serial input, or supply-chain-tampered firmware binaries.

Step 2 — Triggering the Flaw: The attacker invokes the vulnerable kernel API xQueueAddToSet() from their unprivileged task context. Critically, the function must be reachable in the firmware build: configUSE_QUEUE_SETS must be set to 1 (enabled) at compile time, and the target port must have MPU support enabled (e.g., ARM Cortex-M with configENABLE_MPU=1). The attacker passes a queue handle that either: (a) has been previously corrupted via heap overflow to contain an invalid internal type field, or (b) is not a valid queue object at all but rather a pointer to some other kernel structure or controlled buffer. Because the type field is not validated before use, the kernel proceeds to dereference the object and read type-dependent metadata from beyond the legitimate queue structure boundaries.

Step 3 — Payload/Execution: The read operation in xQueueAddToSet() causes the kernel to read a word from a location determined by the corrupted or spoofed queue-type metadata. The attacker can arrange heap layout such that the out-of-bounds read lands on a target region of privileged memory — e.g., a TCB belonging to a kernel-privileged task, the active message buffer of a trusted queue, or the system heap metadata block. Through iterative calls with varying offsets (heap feng shui), the attacker can systematically exfiltrate adjacent kernel memory contents back into their task's accessible memory space.

Step 4 — Post-Exploitation Impact: The exfiltrated data may include:

• Cryptographic keys used for secure boot, TLS/DTLS, or encrypted storage (if these are stored in kernel-protected regions).
• Authentication tokens or session IDs used for inter-task trust boundaries.
• Heap metadata, enabling a subsequent heap-overflow exploit for privilege escalation.
• Task control block contents, including stack pointers and priority levels of other tasks, which can enable targeted manipulation of system state.

If the leaked material contains root private keys or firmware signing keys, the attacker could forge legitimate firmware images, launching a persistent supply-chain attack on the entire device fleet. The confidentiality scope is explicitly marked HIGH in the CVSS vector, underscoring the severity of the data exposure.

An important constraint: this is not a memory-write vulnerability, so the attacker cannot directly inject code or modify kernel state. Any further compromise beyond information disclosure requires chaining this flaw with a separate write primitive.

Impact Assessment

From a business perspective, CVE-2026-77237 poses a high moderate risk to organizations deploying FreeRTOS-based devices. The vulnerability undermines the fundamental isolation guarantee provided by Memory Protection Units — the core security boundary between user tasks and the kernel. When that boundary is violated, all security assurances built on top of it (access control, data confidentiality, inter-process isolation) are nullified.

Affected systems: Any device running a FreeRTOS-Kernel version prior to 11.3.1 compiled with configUSE_QUEUE_SETS=1 on an MPU-capable port. This includes a vast ecosystem of IoT devices, medical devices, automotive ECU components, industrial controllers, smart-grid infrastructure, and consumer electronics built on the FreeRTOS kernel (including devices using the AWS-free-rtos derivative).

Blast radius: The CVSS scope of "Changed" (S:C) is the most critical factor — the attacker proceeds from a low-privilege task to reading high-privilege kernel memory. In multi-tenant embedded environments (e.g., a smart-meter gateway hosting third-party apps), this flaw could allow an app to read the protected memory of other apps or of the core device management stack. While the functional availability impact is none, a successful confidentiality breach often precedes more devastating follow-on attacks (credential theft, key compromise for device counterfeiting, or staging for remote code execution through a chained write primitive).

CVSS subscores context: A Confidentiality Impact of High means complete loss of confidentiality for all resources within the impacted kernel memory region. The Low attack complexity (AC:L) and Low privileges required (PR:L) make this a practical target for malware, rogue third-party application code, or a malicious insider with access to an unprivileged task. The Local attack vector limits remote exploitation, reducing criticality in internet-exposed perimeter devices but not for devices in physical or logical proximity.

Business risk: For manufacturers, an unpatched, exploitable kernel memory disclosure can lead to: product recalls, regulatory penalties (for medical or critical-infrastructure sectors under FDA or IEC 62443 requirements), loss of customer trust, and legal liability. Given that the patch status is currently UNCONFIRMED across tracking sources (Patch Confidence 0/4), devices in the field may remain vulnerable for an extended period.

Detection Guidance

The following detection rules assume a Linux or RTOS-based logging/security-monitoring infrastructure capable of collecting kernel or scheduler events. Detection of this specific vulnerability is challenging because it occurs at the RTOS kernel level; the following rules focus on behavioral indicators — anomalous use of queue-set APIs, unexpected memory access patterns, or the presence of a binary compiled against a vulnerable kernel version.

Sigma Rule

title: Suspicious FreeRTOS Queue Set API Activity
id: 0b1c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: >
  Detects anomalous calls to xQueueAddToSet from an unprivileged task context,
  which may indicate an attempt to exploit CVE-2026-77237 (out-of-bounds read in
  FreeRTOS queue-set handling).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77237
author: ValtersIT Threat Intelligence
date: 2026/06/01
logsource:
  product: freeertos
  service: kernel
detection:
  selection_apicall:
    event.action: "xQueueAddToSet"
  selection_unpriv:
    task.privilege_level: "unprivileged"  # in MPU contexts: USER/DPL1
  selection_return:
    event.result: "success"
  filter_nonerror:
    event.error: 0  # normal successful return
  condition: selection_apicall and selection_unpriv and selection_return and filter_nonerror
  timeframe: 1h
level: medium
tags:
  - attack.t1204.003
  - cve.2026.77237
  - weakness.CWE-125
fields:
  - task.id
  - task.name
  - event.timestamp

YARA Rule

rule CVE_2026_77237_FreeRTOS_Vuln_Binary_Heuristic
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Heuristic detection of FreeRTOS binary compiled prior to 11.3.1 with configUSE_QUEUE_SETS=1, referencing xQueueAddToSet without the security fix."
        date = "2026-06-01"
        severity = "high"
    strings:
        $kern_ref = "FreeRTOS Kernel V10" ascii wide nocase  // version banner 10.x
        $kern_ref2 = "FreeRTOS Kernel V11.0" ascii wide nocase
        $kern_ref3 = "FreeRTOS Kernel V11.1" ascii wide nocase
        $kern_ref4 = "FreeRTOS Kernel V11.2" ascii wide nocase
        $kern_ref5 = "FreeRTOS Kernel V11.3.0" ascii wide nocase  // last vulnerable
        $var_def = "configUSE_QUEUE_SETS" ascii wide nocase
        // MPU-related symbols present in binary
        $mpu_cfg = "pxPortInitialiseStack" ascii wide nocase
        $mpu_cfg2 = "vPortStoreTaskMPUSettings" ascii wide nocase
        $ml = { 71 17 61 72 79 65 71 74 72 63 }  // heuristic: xQueueAddToSet mnemonic adjacency
    condition:
        (any of ($kern_ref*) or any of ($kern_ref2*) or any of ($kern_ref3*) or any of ($kern_ref4*) or any of ($kern_ref5*)) and
        $var_def and
        (any of ($mpu_cfg*) or any of ($mpu_cfg2*))
}

Suricata IDS Rule

# Suricata rule to detect network traffic that may trigger exploitation of CVE-2026-77237
# Note: This vulnerability is local; network detection focuses on recon/delivery phase.
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-77237 likely recon - repeated connection attempts to IoT device admin port"; flow:established,to_server; content:"GET"; http_method; content:"/admin"; http_uri; threshold:type both, track by_src, count 10, seconds 60; reference:cve,2026-77237; classtype:attempted-recon; sid:77237001; rev:1;)

# Detection of malformed firmware image download attempting to inject a user task exploiting the flaw
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-77237 potential malicious firmware update"; content:".bin"; http_uri; flow:established,to_server; pcre:"/[0-9a-f]{32}\.bin/"; reference:cve,2026-77237; classtype:attempted-admin; sid:77237002; rev:1;)

Elastic Detection

// FreeRTOS kernel event monitoring (assuming ECS-compatible RTOS logs)
sequence by task.id with maxspan=5m
  [ logs where event.dataset == "freeertos.kernel" and event.action == "xQueueAddToSet"
    and task.privilege == "unprivileged" ]
  [ logs where event.dataset == "freeertos.kernel" and event.action == "memory_fault"
    and event.code == "MPU_ACCESS_VIOLATION" ]

Splunk SPL Query

index=embedded_rtos sourcetype=freeertos:kernel
| stats count by task_id, task_name, event, timestamp
| search event="xQueueAddToSet" AND privilege_level="unprivileged"
| eval is_vuln_kernel=if(match(version, "^(10\.|11\.[0-2]\.|11\.3\.0)"), "SUSPICIOUS", "OK")
| where is_vuln_kernel="SUSPICIOUS"
| table _time task_name task_id event version privilege_level count
| sort - _time

Wazuh OSSEC Rule

<group name="freeertos,">
  <rule id="772370" level="8">
    <if_sid>510</if_sid>
    <field name="event.action">xQueueAddToSet</field>
    <field name="task.privilege">.*unprivileged.*</field>
    <description>CVE-2026-77237: unprivileged task invoked xQueueAddToSet - potential out-of-bounds read</description>
    <group>cve,freeertos,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

⚠ Patch Confidence: 0/4 — UNPATCHED. This vulnerability is confirmed present in FreeRTOS-Kernel versions up to and including 11.3.0. The upstream vendor has stated in the NVD description that version 11.3.1 or later contains a fix, but no patch evidence, advisory URL, or changelog has been corroborated by any tracked patch source (CVEs, OSV, NVD vendor fix references, GitHub advisory feeds). Treat this vulnerability as actively dangerous: devices cannot be assumed fixed by simply bumping to 11.3.1 until the update is verified.

Immediate Mitigations (compensating controls):

1. Disable queue-set functionality — set configUSE_QUEUE_SETS=0 in FreeRTOSConfig.h and rebuild the firmware if no application code depends on queue sets. This removes the vulnerable code path entirely.
2. Restrict task creation privileges — ensure untrusted third-party tasks cannot be dynamically created on MPU-enabled ports. If configSUPPORT_DYNAMIC_ALLOCATION is enabled, review all tasks with UNPRIVILEGED_FUNCTION access levels.
3. Harden the device boot chain — enforce signed firmware images with a hardware root of trust to prevent the injection of a malicious user task.
4. Network segmentation — isolate devices from direct internet access; restrict management-plane access to trusted VLANs.
5. Monitor for MPU faults — enable fault log capture around xQueueAddToSet and treat any MPU violation during queue-set operation as a critical security event.

Patch/Upgrade Steps:

1. Obtain FreeRTOS-Kernel 11.3.1 from the vendor repository when the fix is corroborated. Verify the source or patch diff specifically modifies the type validation logic inside xQueueAddToSet().
2. Recompile your firmware with the updated kernel and validate that configUSE_QUEUE_SETS=1 still functions correctly via regression testing on your target hardware.
3. Re-sign the new firmware image and roll it out through your OTA update channel.
4. Before phase one production rollout, independently test with a debugger or fault injector to confirm the out-of-bounds read no longer occurs when a malformed queue handle is passed.

Long-Term Hardening:

• Adopt a memory-safe RTOS API usage policy: always call kernel APIs with validated, statically-typed handles; enable compile-time checks (configASSERT()).
• Enable FreeRTOS's built-in stack overflow and heap corruption detection (configCHECK_FOR_STACK_OVERFLOW, configUSE_MALLOC_FAILED_HOOK).
• Conduct periodic security audits of any third-party or in-house task libraries that call queue-set APIs.
• If device security requirements mandate isolation, evaluate moving to a capability-based architecture or using FreeRTOS's trusted-firmware profile mode if available.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-77237 (Official NVD record; source of the description, CVSS vector, and patch guidance.)
2. FreeRTOS Kernel Project — https://github.com/FreeRTOS/FreeRTOS-Kernel (Upstream source repository; version 11.3.1 availability should be monitored here.)
3. CWE-125 — Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html (Weakness classification reference.)
4. MITRE ATT&CK — T1204.003 (User Execution: Malicious Image) — https://attack.mitre.org/techniques/T1204/003/ (Execution tactic relevant to the initial-compromise phase in the exploitation chain.)

Threat actor activity / exploit-in-the-wild: As of the report date, no public exploit code exists, no Nuclei template is available, and CISA has not added this CVE to the KEV (Known Exploited Vulnerabilities) catalog. No confirmed threat-actor campaigns have been observed. However, the severity of a confidentiality breach in a widely deployed RTOS kernel suggests that weaponization is plausible in the near term, particularly in state-sponsored or criminal targeting of critical infrastructure IoT devices.