Vulnerability · Published Nov 2, 2026 · Assigned by eclipse
CVE-2026-115654User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
Medium 6.9
In plain English
A medium-severity improper access control in Eclipse ThreadX from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse ThreadX | 6.0.1 – through 6.5.2.202603 |
Weakness: CWE-284, CWE-862 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N