Live › vulnerability › CVE-2026-115231
In Eclipse ThreadX 6.0.1 through 6.5.2.202603, a user-mode module can post a forged callback request to another module's queue. The receiving module calls the attacker-supplied function pointer without verifying the sender, so the attacker's code runs with that module's privilege.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Systems built on Eclipse ThreadX's Module Manager with memory-protected user-mode modules are exposed. The risk is greatest where a receiving module runs in privileged mode. Teams not using the Module Manager or not running user-mode modules can likely skip it; the sources do not say more.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| threadx | vendor | >= 6.0.1, <= 6.5.2.202603 | 6.5.2.202603b |
6.5.2.202603b (hotfix release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-115231")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.