Eclipse Threadx (Eclipse Foundation) - vulnerabilities (CVEs)
9 CVEs, 8 in the last 30 days, 2 known versions, newest CVE from 2026-10-20. Vendor: Eclipse Foundation.
CVEs of Eclipse Threadx
- CVE-2026-95107 - CVSS 7 (high), 2026-10-20: A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and…
- CVE-2026-94202 - CVSS 4.8 (medium), 2026-10-20: The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay…
- CVE-2026-95108 - CVSS 6.8 (medium), 2026-10-20: One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a `TX_THREAD`…
- CVE-2026-94024 - CVSS 6.9 (medium), 2026-10-20: The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in…
- CVE-2026-94023 - CVSS 6.9 (medium), 2026-10-20: A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the…
- CVE-2026-95109 - CVSS 8.5 (high), 2026-10-20: The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range…
- CVE-2026-94192 - CVSS 8.5 (high), 2026-10-20: A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with…
- CVE-2026-95111 - CVSS 4.8 (medium), 2026-10-20: A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged…
- CVE-2026-0648 - CVSS 7.8 (high), 2026-01-27: The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c)…
