Buffer Over-read when receiving improperly sized ICMPv6 packets

unknownCVE-2025-11616 CVE-2025-11617 CVE-2025-11618

Bulletin ID: AWS-2025-023 Scope: AWS Content Type: Important (requires attention) Publication Date: 2025/10/10 10:15 PM PDT We identified the following CVEs: CVE-2025-11616 - A Buffer Over-read when receiving ICMPv6 packets of certain message types which are smaller than the expected size. CVE-2025-11617 - A Buffer Over-read when receiving a IPv6 packet with incorrect payload lengths in the packet header. CVE-2025-11618 - An invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header. Description: FreeRTOS-Plus-TCP is an open source TCP/IP stack implementation specifically designed for FreeRTOS. The stack provides a standard Berkeley sockets interface and supports essential networking protocols including IPv6, ARP, DHCP, DNS, LLMNR, mDNS, NBNS, RA, ND, ICMP, and ICMPv6. These issues only affect applications using IPv6. Affected versions: v4.0.0 to v4.3.3, if IPv6 support is enabled

CSIRTS triage

vendor: AWS product: FreeRTOS-Plus-TCPOther

What: Buffer over-read issues when receiving improperly sized ICMPv6 packets.
Who is affected: Applications using IPv6 with FreeRTOS-Plus-TCP.
Urgency: Remediation is important to prevent potential crashes or unexpected behavior.
Action: Review and update the handling of ICMPv6 packets.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FreeRTOS-Plus-TCP

Get an email when a new FreeRTOS-Plus-TCP advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-06-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/aws-2025-023/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-116160.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
Low exploitation riskCVE-2025-116170.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
Low exploitation riskCVE-2025-116180.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-11616	coverage & exploitation status	NVD · CVE.org
CVE-2025-11617	coverage & exploitation status	NVD · CVE.org
CVE-2025-11618	coverage & exploitation status	NVD · CVE.org

Recent advisories for Buffer Over-read when

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-53877: An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.…nvd · 2026-07-07
mediumCVE-2026-58013: A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in …nvd · 2026-06-30
mediumCVE-2026-58012: A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when us…nvd · 2026-06-30
mediumCVE-2026-58010: Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()msrc · 2026-06-09
mediumCVE-2026-58012: Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_…msrc · 2026-06-09
mediumCVE-2026-58013: Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"msrc · 2026-06-09