The vulnerability resides in the xQueueAddToSet() function of the FreeRTOS kernel before version 11.3.1. It lacks a validation check for the type of queues being added to a queue set, enabling an unprivileged task on an MPU-enabled FreeRTOS port that has configUSE_QUEUE_SETS enabled to read privileged kernel memory. This flaw arises from an out‑of‑bounds read (CWE-125) caused by type mismatch handling (CWE-843). The consequence is that sensitive kernel data can be disclosed, which could aid further exploitation or cryptanalysis, effectively leaking privileged information to lower privilege code.

Affected products include the FreeRTOS kernel that is part of the FreeRTOS project, specifically any build using version 11.3.0 or earlier that enables queue sets on port implementations supporting MPU (e.g., ARM Cortex-M or similar ports). Systems using the kernel without queue set support or off MPU would not be impacted.

The CVSS score of 8.2 indicates a high severity for this flaw, and while no EPSS score is available it is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability by creating or manipulating a queue set from an unprivileged task; achieving this requires that the system is compiled with configUSE_QUEUE_SETS=1 and an MPU-enabled port. The data read is limited to kernel memory regions that are exposed through the malicious queue set, so an exploiter would need some control of the application logic to access the memory region of interest. There is no publicly known exploitation but the combination of a high CVSS and accessible attack vector makes it a significant risk for embedded systems using these FreeRTOS ports.