CVE-2026-7423: Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB. To mitigate this issue, users should upgrade to the fixed version when available.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7423?
CVE-2026-7423 has a severity rating that indicates it can lead to denial of service due to an integer underflow.
How do I fix CVE-2026-7423?
To remedy CVE-2026-7423, upgrade to FreeRTOS-Plus-TCP versions 4.4.1 or 4.2.6 and ensure outgoing ping support is disabled.
Who is affected by CVE-2026-7423?
CVE-2026-7423 affects users of FreeRTOS-Plus-TCP versions prior to 4.4.1 and 4.2.6.
What can be the impact of CVE-2026-7423?
The impact of CVE-2026-7423 includes system crashes and denial of service when outgoing ping support is enabled.
What type of vulnerability is CVE-2026-7423?
CVE-2026-7423 is classified as an integer underflow vulnerability found in the ICMP echo reply processing.