CVE-2026-77236

This CVE exposes a structural failure at the trust boundary between FreeRTOS normal and secure worlds. When a normal-world caller specifies a stack size for secure-world memory allocation, the secure allocator accepts undersized values without constraint, then corrupts its own heap metadata when attempting to use those undersized regions. The API provides no feedback about what sizes are invalid, making it impossible for developers to write secure code even with legitimate intent. Examination of the 11.3.1 fix is essential: determine whether it adds explicit minimum-size validation at the secure-world entry point, documents required minimums, or both. If only validation was added without clear documentation, the API still fails to communicate requirements to callers. If only documentation was clarified, developers on older versions remain vulnerable with no path to remediation. This pattern is not novel. CVE-2019-11096 in Trusted Firmware-M, CVE-2018-19423 in MCU Xpresso, and CVE-2017-1000415 in Bluetooth firmware all involved unvalidated size parameters across trust boundaries causing heap metadata corruption. This is a known vulnerability class in embedded systems where footprint optimization routinely strips security constraints at security-critical interfaces. For defenders: audit all secure-world entry points in your FreeRTOS-Kernel fork for similar validation gaps. Assume any interface accepting size parameters from the non-secure side is vulnerable until proven otherwise. The deployed base of FreeRTOS in IoT devices, industrial controllers, and connected hardware from 2020-2024 will not receive this update — treat the existing attack surface as permanent.

Reviewed through automated stages and approved by a human before publication.