CVE-2026-77234 is an incorrect authorization vulnerability in FreeRTOS-Kernel identified by AWS. It specifically affects configurations using the FreeRTOS MPU combined with software timers and queue sets enabled (configUSE_QUEUE_SETS=1). The affected versions include =7.0.0 and versions up to <=11.3.0 with MPU-enabled ports. This vulnerability can lead to a complete compromise of confidentiality, integrity, and availability as indicated by the CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The issue is part of a set of four vulnerabilities reported by AWS, but CVE-2026-77234 is distinct in its impact on MPU-enabled configurations. The vendor advisory from AWS does not currently specify a remediation or patch status.

The vulnerability allows incorrect authorization in FreeRTOS-Kernel MPU-enabled configurations, potentially leading to full compromise of system confidentiality, integrity, and availability. This can severely impact embedded systems relying on FreeRTOS-Kernel with MPU and software timers enabled, possibly allowing unauthorized code execution or privilege escalation within the affected environment.

Patch status is not yet confirmed — check the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-086-aws/ for current remediation guidance. Until an official fix is released, users should evaluate their use of MPU and software timers in FreeRTOS-Kernel and consider disabling MPU or queue sets if feasible to reduce exposure.