CVE-2025-5688: Out of Bounds Write in FreeRTOS-Plus-TCP

Severity: high (CVSS 7.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-04 · updated 2026-06-17
Weakness: CWE-787

Description

We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects systems using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled. Users should upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

FreeRTOS-Kernel: from 2.3.4 before 4.3.2 — fixed in 4.3.2

How to fix

Upgrade to a fixed version: FreeRTOS-Kernel 4.3.2. Check the vendor advisory for mitigations.

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-012/
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.3.2
https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-5x4f-fvv8-wr65

Get alerted when CVE-2025-5688 or the next vulnerability affects your stack