CVE-2026-94202
Received Received - Intake

Out-of-Bounds Read in ThreadX Module Manager

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer check, which takes index 1 as the pool start and index 2 as the length to range-check it over. So the out-of-bounds read is performed by the validation code itself, before the kernel service is reached, and the size the caller's pool start is then validated against is a word the manager has not proved the module owns. The other unproved word is read when the service's argument list is built. Vulnerable function: `_txm_module_manager_tx_block_pool_create_dispatch`, in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-94202
EUVD
EUVD-2026-105150

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ThreadX 6.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory safety issue in Eclipse ThreadX's Module Manager block-pool create dispatcher function. The function validates only two of four parameter words from a memory-protected module but reads all four, causing out-of-bounds reads. The dispatcher checks indices 0 and 1 but reads indices 1, 2, and 3, with index 2 (pool size) unvalidated. This allows privileged reads beyond the approved parameter array.

Detection Guidance

Detecting this vulnerability requires checking the Eclipse ThreadX version and inspecting the vulnerable function `_txm_module_manager_tx_block_pool_create_dispatch` in `txm_module_manager_dispatch.h`. Use commands like `grep -r "_txm_module_manager_tx_block_pool_create_dispatch" /path/to/threadx/source` to locate the function. Verify if your system runs ThreadX versions 6.0.1 to 6.5.1.202602a.

Impact Analysis

The vulnerability may cause availability issues or limited information disclosure. It allows malicious modules to trigger privileged reads beyond their approved parameter array, potentially disrupting system operations or leaking sensitive data. The impact is limited due to memory protection constraints.

Mitigation Strategies

Immediately update Eclipse ThreadX to version 6.5.2.202603 or later to patch the vulnerability. If updating is not possible, disable memory-protected modules or restrict module execution to trusted sources. Note that no workarounds preserve the affected feature.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94202. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart