Upgrade FreeRTOS to V11.3.2 to Fix Cortex-R82 Memory Flaws

Amazon has released a security update for the FreeRTOS-Kernel to address two vulnerabilities in its Arm Cortex-R82 processor port. The issues, identified as CVE-2026-109587 and CVE-2026-109588, affect versions 11.3.0 and 11.3.1. According to the National Vulnerability Database, the first flaw carries a CVSS score of 8.8, which is rated as high severity. These bugs only impact systems that use the Memory Protection Unit feature on the specific Arm Cortex-R82 architecture.

In plain English

These vulnerabilities stem from errors in how the operating system checks permissions for memory access. In the first case, the system fails to correctly enforce memory boundaries when a task passes a buffer to a system call. This allows a lower-level task to read or write data in protected kernel areas. The second issue involves a calculation error in buffer length validation, which can also let tasks access memory outside their assigned window.

The background

Amazon distributes the FreeRTOS-Kernel, a real-time operating system designed for microcontrollers and small microprocessors. The company published a security bulletin on October 16, 2026, detailing these findings. The advisory notes that the problems were discovered through a coordinated disclosure process involving Ada Logics Ltd and Anthropic. The issues are specific to builds where the configuration setting configENABLE_MPU is set to 1.

What changes now

Users running affected versions on Arm Cortex-R82 hardware with MPU enabled should upgrade to FreeRTOS-Kernel version 11.3.2 or later. Amazon states that this update addresses both the incorrect authorization and the numeric truncation issues. Applications that do not use the FreeRTOS MPU feature are not affected by these specific vulnerabilities. Teams should also ensure any forked or derivative code incorporates the fixes from the official release.

Key terms explained

A Memory Protection Unit is a hardware feature that prevents software from accessing memory it is not allowed to touch. Unprivileged tasks are programs running with limited permissions, designed to keep them from interfering with core system functions. Privileged kernel memory contains critical operating system data that should only be accessed by the core system itself. When these boundaries fail, lower-level software can potentially disrupt system stability or access sensitive information.

What to do and how to stay safe: FreeRTOS

• Check your inventory for devices running FreeRTOS-Kernel versions 11.3.0 or 11.3.1 on Arm Cortex-R82 processors.
• Verify if your builds have the configENABLE_MPU setting enabled, as only these systems are vulnerable.
• Plan an upgrade to FreeRTOS-Kernel version 11.3.2 or later to apply the official security fixes.
• Review any custom or forked code to ensure it includes the patches provided in the new release.

Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this affect all FreeRTOS users?

No, the flaws only affect Arm Cortex-R82 builds with the Memory Protection Unit enabled in versions 11.3.0 and 11.3.1.

What is the severity of CVE-2026-109587?

The National Vulnerability Database rates CVE-2026-109587 as high severity with a CVSS score of 8.8.

Is there a fix available?

Yes, Amazon recommends upgrading to FreeRTOS-Kernel version 11.3.2 or later to resolve both issues.