Skip to content
Sign in
8.8 High

CVE-2024-28115 FreeRTOS is a real-time operating system for microcontrollers

Description

FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. `configENABLE_MPU` set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper.

Affected products and versions

Product Affected versions Fixed in
FreeRTOS-Kernel 10.6 earliest → < 10.6.2 10.6.2

Other CVEs of FreeRTOS-Kernel

The 8 CVEs of FreeRTOS-Kernel →
CVE-2026-119086 Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on… 6.5 Medium CVE-2026-109588 Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1… 8.8 High CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might… 8.8 High CVE-2026-77237 Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged… 6.5 Medium
Track this CVE