FreeRTOS-Kernel lacks minimum size validation in SecureContext_AllocateContext before version 11.3.1, allowing a local user to supply an undersized stack size and trigger an out‑of‑bounds write that corrupts secure‑world heap metadata. This memory corruption could enable the attacker to alter control data, potentially leading to execution of arbitrary code or a system crash. The vulnerability is a classic buffer overrun (CWE‑787).

The affected product is FreeRTOS Kernel from FreeRTOS. Any installation running a version earlier than 11.3.1 is vulnerable. Version 11.3.1 and later include the fix that enforces proper size checks.

The CVSS score of 8.3 indicates high severity and the EPSS score is not available, suggesting limited public exploit evidence. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires local user privileges and occurs when SecureContext_AllocateContext is invoked with an undersized stack size. Given the local nature of the vector, the risk is concentrated on systems where an untrusted or compromised process can call the function.