Vulnerability · Published Sep 29, 2026 · Assigned by eclipse
CVE-2026-102711Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
Medium 6.9
In plain English
A medium-severity out-of-bounds read in Eclipse ThreadX from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Official description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse ThreadX | 6.0.1 – through 6.5.2.202603 |
Weakness: CWE-125, CWE-345, CWE-1284 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N