Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.9

Eclipse ThreadX lets a low‑level module corrupt nearby memory

CVE-2026-115653 · published 2 days ago
Summary

Versions 6.0.1 through 6.5.2 of Eclipse ThreadX use a routine that saves a paused user thread's data without confirming the thread's stack location. This can let a restricted module overwrite a small amount of memory just beyond its own area and read it back. Update to a newer ThreadX release or apply the vendor's patch to stop the unchecked memory access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
eclipse foundation eclipse threadx <= 6.5.2.202603
Original advisory text
Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
CWE-822Untrusted Pointer Dereference
Timeline
Published2 Nov 2026
Updated3 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-115653 · NVD
CVE-2026-115653 · MITRE
CVE-2026-115653 · OSV
GHSA-c38r-v552-gh5g · GHSA
Track software like this
Free during beta