Eclipse ThreadX/LevelX NAND Flash Translation Layer Metadata Parser lx_nand_flash_open heap-based overflow

Summaryinfo

A vulnerability identified as very critical has been detected in Eclipse ThreadX and LevelX. Affected by this issue is the function lx_nand_flash_open of the component NAND Flash Translation Layer Metadata Parser. The manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2026-102730. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in Eclipse ThreadX and LevelX (affected version not known) and classified as very critical. This issue affects the function lx_nand_flash_open of the component NAND Flash Translation Layer Metadata Parser. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.)

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-102730 since 09/29/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/29/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• LevelX
• ThreadX

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion