FreeRTOS-Plus-TCP CVE-2025-5688 Out of Bounds Write Vulnerability

Key Information Vulnerability Overview CVE ID: CVE-2025-5688 Vulnerability Type: Out of Bounds Write in FreeRTOS-Plus-TCP Affected Scope: AWS Severity: Important (Requires Attention) Release Date: June 4, 2025, 10:00 AM PDT Description FreeRTOS-Plus-TCP is an open-source TCP/IP stack implementation specifically designed for FreeRTOS. This stack provides a standard Berkeley sockets interface and supports multiple network protocols, including IPv6, ARP, DHCP, DNS, LLMNR, mDNS, NBNS, RA, ND, ICMP, and ICMPv6. FreeRTOS-Plus-TCP offers two buffer allocation schemes: 1. Buffer Allocation Scheme 1 – Allocates buffers from a predefined fixed-size buffer pool. 2. Buffer Allocation Scheme 2 – Dynamically allocates buffers of required size from the heap. We have identified that CVE-2025-5688 may allow an out-of-bounds write when processing very long DNS names in LLMNR or mDNS queries. This issue only affects systems using Buffer Allocation Scheme 1 and with LLMNR or mDNS enabled. Affected Versions v2.3.4 to v4.3.1, if using Buffer Allocation Scheme 1 and LLMNR is enabled. v4.0.0 to v4.3.1, if using Buffer Allocation Scheme 1 and mDNS is enabled. Remediation This issue has been resolved in FreeRTOS-Plus-TCP version 4.3.2. It is recommended to upgrade to the latest version and ensure that any forks or derived code include the new fix. Workarounds None. References CVE-2025-5688 GHSA-5x4f-fvv8-wr65 Acknowledgments We thank Purdue University for their collaboration in coordinating the vulnerability disclosure process for this issue.

Goal Reached Thanks to every supporter — we hit 100%!

FreeRTOS-Plus-TCP CVE-2025-5688 Out of Bounds Write Vulnerability