Eclipse ThreadX up to 6.5.1.202602a Module Manager txm_module_manager_dispatch.h _txm_module_manager_tx_block_pool_create_dispatch out-of-bounds

Summaryinfo

A vulnerability categorized as critical has been discovered in Eclipse ThreadX up to 6.5.1.202602a. Affected by this vulnerability is the function _txm_module_manager_tx_block_pool_create_dispatch of the file common_modules/module_manager/inc/txm_module_manager_dispatch.h of the component Module Manager. Such manipulation leads to out-of-bounds. This vulnerability is documented as CVE-2026-94202. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Eclipse ThreadX up to 6.5.1.202602a and classified as critical. Affected by this issue is the function _txm_module_manager_tx_block_pool_create_dispatch of the file common_modules/module_manager/inc/txm_module_manager_dispatch.h of the component Module Manager. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer check, which takes index 1 as the pool start and index 2 as the length to range-check it over. So the out-of-bounds read is performed by the validation code itself, before the kernel service is reached, and the size the caller's pool start is then validated against is a word the manager has not proved the module owns. The other unproved word is read when the service's argument list is built. Vulnerable function: `_txm_module_manager_tx_block_pool_create_dispatch`, in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-94202 since 09/23/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602a

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion