CVE-2024-38373
FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
- EPSS probability
- 0.61%
- CWE
- CWE-126
- Published
- 2024-06-24
- Last modified
- 2026-03-13
Affected products
- FreeRTOS FreeRTOS-Plus-TCP
Weakness type
Related vulnerabilities
- CVE-2026-76653 — Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600
- CVE-2026-83949 — Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-83951 — Microsoft Office Word Information Disclosure Vulnerability
- CVE-2026-81399 — Microsoft Excel Information Disclosure Vulnerability
- CVE-2026-78516 — Windows Storage Information Disclosure Vulnerability
- CVE-2026-72974 — Microsoft Office Excel Information Disclosure Vulnerability
- CVE-2026-69626 — Microsoft Office Information Disclosure Vulnerability
- CVE-2026-72932 — Windows Message Queuing Queue Manager Information Disclosure Vulnerability