The vulnerability is an integer underflow (CWE-191) in FreeRTOS-Plus-TCP's ICMP and ICMPv6 echo reply handlers prior to versions 4.4.1 and 4.2.6. The issue arises because the code subtracts header sizes from a packet length field without validating that the length is large enough, resulting in a heap out-of-bounds read of about 65KB. This can be triggered by an adjacent network attacker causing a denial of service (device crash) when outgoing ping support is enabled. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with attack vector adjacent network, high attack complexity, no privileges required, no user interaction, and impacts availability only. AWS manages remediation for this cloud-hosted service and has released fixed versions to mitigate the issue.

Successful exploitation leads to a denial of service condition by crashing the affected device due to a heap out-of-bounds read caused by integer underflow. There is no impact on confidentiality or integrity. The attack requires adjacency on the network and has high complexity, limiting exploitability. No known exploits are reported in the wild.

A patch is available from AWS in FreeRTOS-Plus-TCP versions 4.4.1 and 4.2.6. Users should upgrade to these fixed versions to remediate the vulnerability. Since this is a cloud service managed by AWS, the vendor handles remediation for the cloud-hosted components. Refer to the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-021-aws/ for official guidance and updates.