6.9
Medium
CVE-2026-102711 Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
Description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.
CVSS 4.0 detail
Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:NExploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- Interaction
- None
- Confidentiality
- High
- Integrity
- None
- Availability
- Low
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| `eclipse-threadx/threadx` (module manager / loadable-module loader) | Versions not published | |
| Eclipse ThreadX 6.5 | earliest → < 6.5.2.202603b | 6.5.2.202603b |
| Eclipse ThreadX 6.0 | 6.0.1 → 6.5.2.202603 | No fix stated |
References
- github.com github.com
Timeline
- Published
- Last modified