Eclipse Foundation Eclipse ThreadX

• CVE-2026-113421 High 7.3 ThreadX Modules invokes trace-full callbacks after module unload 0.1%
• CVE-2026-115231 High 8.5 User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege 0.1%
• CVE-2026-115215 High 8.7 NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool 0.4%
• CVE-2026-115403 High 8.2 NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full 0.3%
• CVE-2026-115654 Medium 6.9 User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own 0.1%
• CVE-2026-115653 High 7.0 Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode 0.1%
• CVE-2026-118052 Medium 6.8 Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation 0.1%
• CVE-2026-95107 High 7.0 Module object allocation size overflow corrupts the manager object pool 0.2%
• CVE-2026-94202 Medium 4.8 Module block-pool create validates two of the four parameter words it reads 0.2%
• CVE-2026-95108 Medium 6.8 Deleting a user-mode module thread leaks its privileged kernel stack 0.2%
• CVE-2026-94024 Medium 6.9 Module Manager object lookup validates one byte of a module's search name 0.1%
• CVE-2026-94023 Medium 6.9 Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion 0.1%
• CVE-2026-95109 High 8.5 Cortex-A7 module data validation checks only the first address of a caller-supplied range 0.1%
• CVE-2026-94192 High 8.5 Module object deallocation can free a live ThreadX kernel object 0.1%
• CVE-2026-95111 Medium 4.8 Module queue front-send validates a word count as a byte count 0.1%
• CVE-2026-102711 Medium 6.9 Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader <0.1%
• CVE-2026-102710 High 8.5 In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's tra <0.1%
• CVE-2026-102709 High 8.4 In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world witho 0.1%
• CVE-2026-0648 High 7.8 The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_ 0.1%