A heap buffer overflow in AWS FreeRTOS-Plus-TCP allows adjacent network attackers to cause memory corruption, potentially leading to system instability or arbitrary code execution.

The vulnerability is an out-of-bounds write (CWE-787) caused by insufficient validation of the prefix length field during IPv6 Router Advertisement processing. An unauthenticated attacker on the local network segment can send a malformed packet to trigger a heap buffer overflow.

The CVSS score of 8.1 indicates a high-severity risk, primarily due to the potential for memory corruption which could be leveraged for system compromise. In an embedded context, this could result in device crashes, denial of service, or unauthorized control over critical hardware functions, leading to significant operational disruption.

Immediate Action: Update AWS FreeRTOS-Plus-TCP to version 4.2.6 or 4.4.1 as appropriate for your branch to remediate the buffer overflow vulnerability.

Proactive Monitoring: Monitor network traffic for anomalous IPv6 Router Advertisement packets, particularly those originating from untrusted or unexpected sources on the local network.

Compensating Controls: If immediate patching is not feasible, restrict network access to the affected devices to trusted segments and disable IPv6 if it is not required for the specific deployment.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for memory corruption and the high CVSS severity, organizations utilizing AWS FreeRTOS-Plus-TCP must prioritize the application of the provided patches. Administrators should verify their current versioning and transition to 4.2.6 or 4.4.1 immediately to eliminate the risk of exploitation by adjacent network actors.