CVE-2026-94024
Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in ThreadX Module Manager

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one. A module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life. Vulnerable functions: `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch` (both in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`) and `_txm_module_manager_object_name_compare` (`common_modules/module_manager/src/txm_module_manager_util.c`).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-10
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-94024
EUVD
EUVD-2026-105147

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ThreadX 6.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in the Module Manager's object lookup process in Eclipse ThreadX. It validates only one byte of a memory-protected module's search name before walking the entire declared length of the name in privileged mode. The kernel's preemption count is raised during this process, meaning if the walk encounters memory that cannot be read, the kernel may fault and become unable to preempt for the rest of the system's operation.

Detection Guidance

To detect this vulnerability, check if your system is running Eclipse ThreadX versions 6.0.1 through 6.5.1.202602a. Use commands like 'git log' or version checks in your ThreadX installation directory to verify the version. If you are using a vulnerable version, update to ThreadX 6.5.2.202603 or later to mitigate the issue.

Impact Analysis

This vulnerability could allow a module to cause a system-wide denial of service by triggering a kernel fault that prevents preemption. This would halt the entire system, as the kernel cannot recover or handle other tasks until the system is rebooted.

Compliance Impact

This vulnerability primarily impacts system availability and integrity due to potential kernel faults causing permanent preemption disablement, which could lead to system unavailability. While confidentiality impact is limited, the resulting system instability may violate compliance requirements for availability and integrity in standards like GDPR (data processing integrity) and HIPAA (system availability for protected health information).

Mitigation Strategies

Update or patch the Eclipse ThreadX module manager to address the unbounded memory walk issue in the vulnerable functions. Disable or restrict untrusted modules from accessing privileged memory regions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...