Buffer Over-read when receiving improperly sized ICMPv6 packets
Bulletin ID: AWS-2025-023
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 2025/10/10 10:15 AM PDT
We identified the following CVEs:
- CVE-2025-11616 - A Buffer Over-read when receiving ICMPv6 packets of certain message types which are smaller than the expected size.
- CVE-2025-11617 - A Buffer Over-read when receiving a IPv6 packet with incorrect payload lengths in the packet header.
- CVE-2025-11618 - An invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header.
Description:
FreeRTOS-Plus-TCP is an open source TCP/IP stack implementation specifically designed for FreeRTOS. The stack provides a standard Berkeley sockets interface and supports essential networking protocols including IPv6, ARP, DHCP, DNS, LLMNR, mDNS, NBNS, RA, ND, ICMP, and ICMPv6.
These issues only affect applications using IPv6.
Affected versions: v4.0.0 to v4.3.3, if IPv6 support is enabled
Resolution:
This issue has been addressed in FreeRTOS-Plus-TCP version 4.3.4. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
None.
Acknowledgement:
We would like to thank Mayhem Security for collaborating on this issue through the coordinated vulnerability disclosure process.
References:
Please email aws-security@amazon.com with any security questions or concerns.