Vulnerability · 1 source · latest 3d

FreeRTOS-Kernel queue-set flaw lets unprivileged tasks trigger privileged out-of-bounds write (CVE-2026-119086)

VULNERABILITYCVE-2026-119086redteam/daily · 1 source

Severity: High
Highest CVSS: 8.2
Exploited: Not known
Sources: 1

What happened

AWS has disclosed CVE-2026-119086, a missing type validation issue in xQueueSelectFromSet in FreeRTOS-Kernel. On MPU-enabled builds with queue sets enabled, an unprivileged task can make the kernel write beyond the intended destination while running in a privileged context, affecting the integrity of privileged execution. Builds without queue sets are not affected.

For IT people · Written by AI from 1 source · Wrong?

What to do

Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist

General advice for this kind of story

Read the full story at the source

Vulnerabilities

CVE-2026-119086CVSS 8.2Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged m

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins

Who and what is in it

Companies

Amazon AWS