AWS Updates - 2025-10-10

AWS Security Bulletins

Buffer Over-read when receiving improperly sized ICMPv6 packets

• Link: https://aws.amazon.com/security/security-bulletins/rss/aws-2025-023/
• Published: 2025-10-10

Bulletin ID: AWS-2025-023
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 2025/10/10 10:15 PM PDT

We identified the following CVEs:

CVE-2025-11616 - A Buffer Over-read when receiving ICMPv6 packets of certain message types which are smaller than the expected size.
CVE-2025-11617 - A Buffer Over-read when receiving a IPv6 packet with incorrect payload lengths in the packet header.
CVE-2025-11618 - An invalid pointer dereference when receiving a UDP/IPv6 packet with an incorrect IP version field in the packet header.

Description:

FreeRTOS-Plus-TCP is an open source TCP/IP stack implementation specifically designed for FreeRTOS. The stack provides a standard Berkeley sockets interface and supports essential networking protocols including IPv6, ARP, DHCP, DNS, LLMNR, mDNS, NBNS, RA, ND, ICMP, and ICMPv6.

These issues only affect applications using IPv6.

Affected versions:

v4.0.0 to v4.3.3, if IPv6 support is enabled