CVE-2026-7423 Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service device crash when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without...

CVE-2026-7423

The CVE affects FreeRTOS-Plus-TCP: an integer underflow in ICMP/ICMPv6 echo reply handling prior to V4.4.1 and V4.2.6. Subtracting header sizes from a packet length without validating size enables a heap out-of-bounds read (~65KB), allowing an adjacent attacker to cause a device crash (DoS) when ...

PT-2026-35974

Name of the Vulnerable Software and Affected Versions FreeRTOS-Plus-TCP versions prior to V4.4.1 FreeRTOS-Plus-TCP versions prior to V4.2.6 Description An integer underflow exists in the ICMP and ICMPv6 echo reply handlers when outgoing ping support is enabled. This occurs because header sizes ar...