Out-of-bounds read in Eclipse ThreadX module queue front-send
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Eclipse ThreadX from 6.0.1 through 6.5.1.202602a is affected. The front-send dispatcher passes a word count where a byte count is required, so the privileged queue copy in _txe_queue_front_send can read 3 * message_size bytes past the end of memory the module is allowed to read (CWE-131). A local attacker with low privileges can trigger this, and the copied words are written into the queue message area where a module that receives from that queue can read them.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes. The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied. A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX | 6.0.1 – 6.5.1.202602a | 6.5.2.202603 | Patch available | CNA |
- Eclipse ThreadX VendorEclipse Foundation Affected 6.0.1 – 6.5.1.202602a Fixed in 6.5.2.202603 Patch available CNA
Remediation
Update Eclipse ThreadX to version 6.5.2.202603, which fixes this issue. Versions from 6.0.1 through 6.5.1.202602a are affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Eclipse ThreadX (Eclipse Foundation) Fixed in 6.5.2.202603
Timeline
- 2026-10-20 Threatist record created from CVE-2026-95111
More Eclipse Foundation vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
- TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
- TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
- TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
- TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences