An integer underflow in the ICMP and ICMPv6 echo reply handlers of FreeRTOS-Plus-TCP causes a heap out‑of‑bounds read when a packet length field is reduced by the header size without checking for validity. The resulting memory corruption can crash the device, interrupting normal operation and leading to a denial‑of‑service condition for applications relying on the TCP/IP stack.

AWS managed FreeRTOS-Plus-TCP deployments using version 4.4.0 or earlier, and any release processed under the V4.2.6 branch before the fix was applied, are vulnerable. Systems that rely on the FreeRTOS-Plus-TCP stack and allow outgoing ping responses are at risk.

The vulnerability carries a CVSS score of 6, indicating moderate severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The issue is not listed in the CISA KEV catalog. Attacks can be launched by an adjacent network user who sends crafted ICMP or ICMPv6 packets to trigger the underflow, which then causes the device to crash. Because the flaw is in the packet processing path, it can be triggered remotely from the network.