Security readout for executives and security teams
Plain-English summary
A flaw in FreeRTOS-Kernel timer command handling could let a low-privileged task take control of the protected kernel on MPU-enabled devices. Successful exploitation could compromise confidentiality, integrity, availability, and connected systems. The issue requires local task access rather than direct network access.
Executive priority
Treat as an urgent embedded-product remediation issue where MPU-enabled FreeRTOS runs unprivileged tasks. Inventory affected firmware immediately, prioritize exposed or safety-critical devices, and schedule controlled upgrades. Systems without the affected configuration should document evidence before deprioritization.
Technical view
FreeRTOS-Kernel before 11.3.1 improperly validates timer command input. On MPU-enabled ports, an unprivileged task may execute code in privileged kernel context. CVSS 4.0 rates it 9.3 with local, low-complexity, low-privilege exploitation and no user interaction. The supplied classification is CWE-863.
Likely exposure
Exposure is most likely in products embedding FreeRTOS-Kernel versions before 11.3.1, using an MPU-enabled port, and running potentially untrusted or compromised unprivileged tasks. Network reachability alone does not establish exposure. The supplied structured version entry conflicts with the broader description, so firmware inventories require verification.
Exploitation context
The supplied CVSS vector describes local exploitation requiring low privileges, without user interaction. The bundle reports that the CVE is not in KEV and provides no evidence of active exploitation or a public exploit. Absence from KEV does not establish that exploitation is impossible.
Researcher notes
The bundle is internally inconsistent: its description says versions before 11.3.1 may be affected, while the structured affected entry lists only 7.0.0 and marks the default status unaffected. Confirm authoritative version ranges in the linked advisory and CVE record. No root-cause detail beyond improper validation of timer commands is supplied.
Mitigation direction
- Upgrade FreeRTOS-Kernel to version 11.3.1 or later.
- Check the AWS bulletin and FreeRTOS advisory for product-specific guidance.
- Prioritize firmware containing MPU-enabled FreeRTOS ports and untrusted task workloads.
- Apply compensating access restrictions if affected firmware cannot be upgraded promptly.
Validation and detection
- Confirm the exact FreeRTOS-Kernel version in source, lockfiles, firmware manifests, and binaries.
- Determine whether the deployed FreeRTOS port enables MPU isolation.
- Identify unprivileged tasks that can reach timer command handling.
- Verify rebuilt firmware uses version 11.3.1 or later.
- Retest affected device functions and privilege boundaries after upgrading.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-77234 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——AMZNCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26AMZNVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.1CVE reference, AMZN · patch
- https://aws.amazon.com/security/security-bulletins/2026-086-aws/CVE reference, AMZN · vendor-advisory
- https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-w3vr-pr75-5hc6CVE reference, AMZN · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.