CVE-2025-11616: CWE-126: Buffer Over-read in AWS FreeRTOS-Plus_TCP
Bulletin ID: AWS-2025-023 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/10/10 10:15 PM PDT We identified the following CVEs: CVE-2025-11616 - A Buffer Over-read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. CVE-2025-11617 - A Buffer Over-read when receiving a IPv6 packet with incorrect payload lengths in the packet header. CVE-2025-11618 - An invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. Description: FreeRTOS-Plus-TCP is an open source TCP/IP stack implementation specifically designed for FreeRTOS. The stack provides a standard Berkeley sockets interface and supports essential networking protocols including IPv6, ARP, DHCP, DNS, LLMNR, mDNS, NBNS, RA, ND, ICMP, and ICMPv6. These issues only affect applications using IPv6. Affected versions: v4.0.0 to v4.3.3, if IPv6 support is enabled
AI Analysis
Technical Summary
This vulnerability (CVE-2025-11616) in AWS FreeRTOS-Plus_TCP 4.0.0 involves a missing validation check during ICMPv6 packet processing. Specifically, when processing certain ICMPv6 message types that are smaller than expected, the code performs an out-of-bounds read, classified as CWE-126 (Buffer Over-read). This can cause application instability or potential information disclosure. The CVSS 4.0 base score is 5.3, indicating medium severity. No exploits are currently known in the wild. The vulnerability affects IPv6 applications using this version of FreeRTOS-Plus_TCP.
Potential Impact
The vulnerability can cause application instability or information disclosure due to out-of-bounds reads in ICMPv6 packet processing. There are no reports of active exploitation. The impact is limited to affected versions of AWS FreeRTOS-Plus_TCP 4.0.0 running IPv6 applications.
Mitigation Recommendations
Users should upgrade to the latest version of AWS FreeRTOS-Plus_TCP where this vulnerability is addressed. Since no official patch link is provided, check the vendor advisory for the latest patched version and apply updates accordingly. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, users should review and patch any derivative code that processes ICMPv6 packets.
CVE-2025-11616: CWE-126: Buffer Over-read in AWS FreeRTOS-Plus_TCP
Description
Bulletin ID: AWS-2025-023 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/10/10 10:15 PM PDT We identified the following CVEs: CVE-2025-11616 - A Buffer Over-read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. CVE-2025-11617 - A Buffer Over-read when receiving a IPv6 packet with incorrect payload lengths in the packet header. CVE-2025-11618 - An invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. Description: FreeRTOS-Plus-TCP is an open source TCP/IP stack implementation specifically designed for FreeRTOS. The stack provides a standard Berkeley sockets interface and supports essential networking protocols including IPv6, ARP, DHCP, DNS, LLMNR, mDNS, NBNS, RA, ND, ICMP, and ICMPv6. These issues only affect applications using IPv6. Affected versions: v4.0.0 to v4.3.3, if IPv6 support is enabled
CVSS v4.0
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2025-11616) in AWS FreeRTOS-Plus_TCP 4.0.0 involves a missing validation check during ICMPv6 packet processing. Specifically, when processing certain ICMPv6 message types that are smaller than expected, the code performs an out-of-bounds read, classified as CWE-126 (Buffer Over-read). This can cause application instability or potential information disclosure. The CVSS 4.0 base score is 5.3, indicating medium severity. No exploits are currently known in the wild. The vulnerability affects IPv6 applications using this version of FreeRTOS-Plus_TCP.
Potential Impact
The vulnerability can cause application instability or information disclosure due to out-of-bounds reads in ICMPv6 packet processing. There are no reports of active exploitation. The impact is limited to affected versions of AWS FreeRTOS-Plus_TCP 4.0.0 running IPv6 applications.
Mitigation Recommendations
Users should upgrade to the latest version of AWS FreeRTOS-Plus_TCP where this vulnerability is addressed. Since no official patch link is provided, check the vendor advisory for the latest patched version and apply updates accordingly. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, users should review and patch any derivative code that processes ICMPv6 packets.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- AMZN
- Date Reserved
- 2025-10-10T16:49:23.383Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68e94174a46c174737d6e76a
Added to database: 10/10/2025, 17:25:08 UTC
Last enriched: 06/05/2026, 19:28:43 UTC
Last updated: 08/19/2026, 22:52:06 UTC
Views: 277
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.