Multiple RTOS (Update E)

An integer overflow in malloc/memory allocation routines used by embedded RTOS systems could allow remote code execution or crash devices that manage critical infrastructure processes. This affects real-time operating systems running on controllers, gateways, and safety-critical devices across healthcare, energy, and industrial sectors.

This advisory affects multiple real-time operating systems (RTOS) used in embedded devices across healthcare, energy, and industrial sectors. Primary impact includes: Hitachi Energy devices (GMS600, PWC600, REB500, Relion 670/650, RTU500 CMU, MSM) using Windriver VxWorks; Texas Instruments wireless microcontrollers and energy management systems (CC32XX, SimpleLink CC13XX/CC26XX, MSP432E4); BlackBerry QNX safety-critical systems (medical devices, safety controllers); NXP controllers used in industrial gateways; ARM Mbed devices in IoT deployments; Amazon FreeRTOS in cloud-connected embedded systems. Any IoT device, wireless sensor, safety controller, or remote gateway running these vulnerable RTOS versions is affected.

An attacker with network access to a device running a vulnerable RTOS can send a specially crafted packet or input that triggers an integer overflow in memory allocation. This overflow allows the attacker to execute arbitrary code on the device or cause it to crash, potentially disrupting critical process control functions.