7.0
High
CVE-2026-95107 A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`
Description
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse ThreadX 6.5 | earliest → < 6.5.2.202603 | 6.5.2.202603 |
| Eclipse ThreadX 6.0 | 6.0.1 → 6.5.1.202602a | No fix stated |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Eclipse ThreadX
The 20 CVEs of Eclipse ThreadX →
CVE-2026-113421
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full…
7.3
High
CVE-2026-115231
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module…
8.5
High
CVE-2026-115215
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its…
8.7
High
CVE-2026-115403
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw…
8.2
High