8.4
High
CVE-2026-102709 In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the…
Description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-secure code can make the secure firmware reveal which secure bytes are zero, write chosen secure words, and fault the secure world, breaking TrustZone-M isolation and enabling recovery of secure-world secrets such as cryptographic keys.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ThreadX 6.5 | earliest → 6.5.1.202602 | No fix stated |
| Eclipse ThreadX 6.5 | earliest → < 6.5.2.202603b | 6.5.2.202603b |
| Eclipse ThreadX 6.0 | 6.0.1 → 6.5.2.202603 | No fix stated |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of ThreadX
The 14 CVEs of ThreadX →
CVE-2026-102757
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing,…
8.5
High
CVE-2025-55080
In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough,…
7.2
High
CVE-2025-55079
In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority
5.7
Medium
CVE-2025-55078
In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a…
5.7
Medium