7.0
Élevée
CVE-2026-95107 A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`
Description
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eclipse ThreadX 6.5 | premières → < 6.5.2.202603 | 6.5.2.202603 |
| Eclipse ThreadX 6.0 | 6.0.1 → 6.5.1.202602a | Pas de correctif indiqué |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Eclipse ThreadX
Les 20 CVE de Eclipse ThreadX →
CVE-2026-113421
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full…
7.3
Élevée
CVE-2026-115231
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module…
8.5
Élevée
CVE-2026-115215
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its…
8.7
Élevée
CVE-2026-115403
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw…
8.2
Élevée