Bulletin ID: 2026-158-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 10/30/2026 10:30 AM PDT

Description:

FreeRTOS-Kernel is a real-time operating system kernel for microcontrollers and small microprocessors, distributed by Amazon. We identified CVE-2026-119086, the queue-set selection path does not fully validate that the referenced kernel object is a queue set before operating on it. On MPU-enabled builds with queue sets enabled, an unprivileged task can cause the kernel to write beyond the intended destination while executing in a privileged context, which affects the integrity of privileged execution. Applications that are built without queue sets are not affected.

Impacted versions: >=V7.4.0 AND <=V11.3.2 (MPU-enabled ports with configUSE_QUEUE_SETS=1)

Resolution:

This issue has been addressed in FreeRTOS-Kernel version V11.3.3. We recommend upgrading to FreeRTOS-Kernel V11.3.3 (or later), rebuilding, and reflashing affected firmware. Ensure any forked or derivative code is also patched to incorporate the fix.

Workarounds:

This issue does not affect builds that do not enable queue sets. If using queue sets, upgrading to the fixed version is the recommended remediation.

References:

• CVE-2026-119086
• GHSA-56j9-g43f-8g6v

Acknowledgement:

We would like to thank Claude (Anthropic) and Ada Logics for collaborating on this issue through the coordinated vulnerability disclosure process.

Please email aws-security@amazon.com with any security questions or concerns.