Eclipse ThreadX up to 6.4.3 tx_osek.c CreateCounter function return value

Summaryinfo

A vulnerability classified as problematic has been found in Eclipse ThreadX up to 6.4.3. Affected by this vulnerability is the function CreateCounter of the file threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c. The manipulation leads to function return value. This vulnerability is listed as CVE-2026-0648. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in Eclipse ThreadX up to 6.4.3 and classified as problematic. This issue affects the function CreateCounter of the file threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c. The manipulation with an unknown input leads to a function return value vulnerability. Using CWE to declare the problem leads to CWE-253. The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_counter(). Specifically, the current code checks if cntr_id equals 0u to determine failure, but @osek_get_counter() actually returns E_OS_SYS_STACK (defined as 12U) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted. As a result, when the counter pool is depleted, the code proceeds to cast the error code (12U) to a pointer (OSEK_COUNTER *), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., 0x0000000C), which can trigger immediate HardFaults or silent memory corruption. This vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access.

The weakness was presented by Lavine Yue. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-0648 since 01/06/2026. The exploitation is known to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion