https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-7426.htmlhttps://patchthecve.com/cve/CVE-2026-7426.htmlMon, 26 Oct 2026 20:10:00 +0000HIGH 8.1: Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid lengthhttps://patchthecve.com/cve/CVE-2026-7425.htmlhttps://patchthecve.com/cve/CVE-2026-7425.htmlMon, 26 Oct 2026 20:10:00 +0000MEDIUM 6.5: Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause a denial of service (device crash) by sending a crafted Router Advertisement with a truncated PREFIX_INFORMATION option that is smallehttps://patchthecve.com/cve/CVE-2026-7424.htmlhttps://patchthecve.com/cve/CVE-2026-7424.htmlMon, 26 Oct 2026 20:10:00 +0000HIGH 8.1: Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service (permanent IP task freeze requiring hardware reset) bhttps://patchthecve.com/cve/CVE-2026-7423.htmlhttps://patchthecve.com/cve/CVE-2026-7423.htmlMon, 26 Oct 2026 20:10:00 +0000MEDIUM 5.3: Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validathttps://patchthecve.com/cve/CVE-2026-7422.htmlhttps://patchthecve.com/cve/CVE-2026-7422.htmlMon, 26 Oct 2026 20:10:00 +0000MEDIUM 6.5: Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass all checksum and minimum-size validation by spoofing the Ethernet source MAC address to match one of the device's own registered endpoints, because the loopback detection mechanism