CVE WatchOct 30, 2026

CVE-2026-119086

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue s

CVSS

6.5

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 30, 2026 · Last modified: Oct 30, 2026 · CWE-121 · CWE-843

EPSS · 30d

Not enough EPSS history yet.

Technical description

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary. To remediate this issue, users should upgrade to FreeRTOS-Kernel V11.3.3, rebuild, and reflash affected firmware. Builds that do not enable queue sets are not affected.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-784039.8 CRI

—

———Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.5h CVE-2026-784027.8 HIG

—

———Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the input message. A local attacker may craft an input and send it to Sentinel Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling local privilege escalation. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.5h CVE-2026-1195287.8 HIG

—

———A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.5h CVE-2026-65584—

—

——0Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded from the stack array. Successful exploitation can cause kernel memory corruption and typically results in a denial-of-service condition through a kernel crash. The code vulnerability is a buffer write beyond the allocated array on the stack caused by copying excessive data from an internal buffer.6h CVE-2026-961877.4 HIG

—

——0Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.11h CVE-2026-880905.4 MED

—

——0Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.7h