CVE-2026-119086

    Dashboard / Vulnerabilities / CVE-2026-119086

    CVE-2026-119086

    Published: 30 Oct 2026Last Modified: 5 Nov 2026

    Summary: Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

    Details: Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary. To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.

    References: https://aws.amazon.com/security/security-bulletins/2026-158-aws/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119086.json, https://github.com/FreeRTOS/FreeRTOS-Kernel/security/advisories/GHSA-56j9-g43f-8g6v, https://nvd.nist.gov/vuln/detail/CVE-2026-119086, https://github.com/FreeRTOS/FreeRTOS-Kernel/releases/tag/V11.3.3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ab65cc60c9e1d5a10fa960e3813fcb2ef3f3f723
    Fixed -89592801dd8b73329a7583719b7e3567b50910e5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119086 | CVE-DB