Eclipse ThreadX up to 6.5.1.202602a Module Manager txm_module_object_allocate object_size integer overflow

Summaryinfo

A vulnerability labeled as very critical has been found in Eclipse ThreadX up to 6.5.1.202602a. This affects the function txm_module_object_allocate of the component Module Manager. Executing a manipulation of the argument object_size can lead to integer overflow. This vulnerability appears as CVE-2026-95107. The attack requires local access. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Eclipse ThreadX up to 6.5.1.202602a. It has been declared as very critical. This vulnerability affects the function txm_module_object_allocate of the component Module Manager. The manipulation of the argument object_size with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-95107 since 09/23/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/20/2026).

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602a

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion