CVE-2026-95107GHSA-63qc-jcr6-qw6r
Eclipse ThreadX: Module object allocation size overflow corrupts the manager object pool
Eclipse Foundation Eclipse ThreadX
CVSS
7.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.5.2.202603ThreadX, eclipse threadxGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A ThreadX module chooses object_size when it calls txm_module_object_allocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.
Text from CVE List
Affected versions 3
- Eclipse ThreadXaffected: 6.0.1 through 6.5.1.202602aCVE List
- Eclipse ThreadXunaffected: 6.5.2.202603CVE List
- ThreadX, eclipse threadx>= 6.0.1, <= 6.5.1.202602aGitHub