CVE-2026-102711
Awaiting Analysis Awaiting Analysis - Queue

ThreadX Module Loader Heap OOB Read and CFI Gap

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Eclipse Foundation

Description
Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_in_place_load` — APIs that take ONLY a base pointer, no image length, so every size/offset field in `TXM_MODULE_PREAMBLE` is fully attacker-trusted: (1) a heap OOB **read** (`code_size` trusted as the source-image length in the code-copy loop), and (2) a control-flow-integrity / defense-in-depth gap (module entry/start/callback/stop pointers computed as `code_start + preamble_offset` with only a `!= 0` check, and the preamble `checksum` never verified). No controlled OOB write was found (honest — the copy destination is overflow-guarded).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-10-19
AI Q&A
2026-09-29
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102711
EUVD
EUVD-2026-89174

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
expresslogic threadx *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves two issues in the ThreadX loadable-module loader. When a device loads a malicious module via specific APIs, the system trusts attacker-controlled size and offset values in the module preamble. This leads to a heap out-of-bounds read due to incorrect handling of the code size field. Additionally, pointers for module entry and callbacks are computed without proper validation or checksum verification, creating a control-flow integrity gap.

Detection Guidance

This vulnerability involves issues in the ThreadX loadable-module loader, specifically when loading attacker-controlled module objects. Detection requires analyzing memory handling and module loading processes in ThreadX-based systems. No specific commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to read sensitive memory contents, potentially exposing confidential data. While no direct write primitive was found, the out-of-bounds read may enable further attacks like information disclosure or denial of service by corrupting system state.

Compliance Impact

This vulnerability involves out-of-bounds memory reads and unchecked module entry points in ThreadX, which could lead to unauthorized code execution or data exposure. Such flaws may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Disable loading of attacker-controlled module objects via ThreadX APIs like _txm_module_manager_memory_load and _txm_module_manager_in_place_load. Validate all module image lengths and checksums before processing. Restrict module loading to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart