Eclipse ThreadX up to 6.5.1.202602a Module Manager txm_module_manager_dispatch.h length buffer overflow

Summaryinfo

A vulnerability was found in Eclipse ThreadX up to 6.5.1.202602a. It has been declared as very critical. This impacts the function _txm_module_manager_txm_module_object_pointer_get_dispatch/_txm_module_manager_txm_module_object_pointer_get_extended_dispatch/_txm_module_manager_object_name_compare of the file common_modules/module_manager/inc/txm_module_manager_dispatch.h of the component Module Manager. The manipulation of the argument length results in buffer overflow. This vulnerability is cataloged as CVE-2026-94024. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Eclipse ThreadX up to 6.5.1.202602a. Affected is the function _txm_module_manager_txm_module_object_pointer_get_dispatch/_txm_module_manager_txm_module_object_pointer_get_extended_dispatch/_txm_module_manager_object_name_compare of the file common_modules/module_manager/inc/txm_module_manager_dispatch.h of the component Module Manager. The manipulation of the argument length with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one. A module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life. Vulnerable functions: `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch` (both in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`) and `_txm_module_manager_object_name_compare` (`common_modules/module_manager/src/txm_module_manager_util.c`).

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-94024 since 09/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/20/2026).

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602a

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion