{"id":"CVE-2026-115231","kind":"vulnerability","aliases":["CVE-2026-115231"],"related":[],"title":"Eclipse ThreadX: user-mode module can run code with privileged access","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.","summary":"In Eclipse ThreadX 6.0.1 through 6.5.2.202603, a user-mode module can post a forged callback request to another module's queue. The receiving module calls the attacker-supplied function pointer without verifying the sender, so the attacker's code runs with that module's privilege.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"threadx","fixed":["6.5.2.202603b"],"affected":">= 6.0.1, <= 6.5.2.202603","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","module-manager","rtos","runtime","threadx"],"not_affected_if":["module-manager-unused","no-user-mode-modules"],"how_to_check":"- Check your ThreadX version: 6.0.1 through 6.5.2.202603 is affected; 6.5.2.202603b is fixed.\n- Check whether your build uses the ThreadX Module Manager with memory-protected user-mode modules (ThreadX Modules). If it does not, it is not reachable.\n- Check whether any module that owns a callback request queue runs in privileged mode; that is where forged callbacks gain privilege.","fix":"Upgrade to Eclipse ThreadX 6.5.2.202603b (hotfix release). After the fix a memory-protected module can no longer send to, flush or receive from another module's callback request queue (returns TXM_MODULE_INVALID); designs relying on that need a shared synchronisation object instead.","status":"open","published_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:17+00:00","updated_at":"2026-11-03T09:21:11+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-03T09:20:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Eclipse ThreadX: user-mode module can run code with privileged access","impact":"high","summary":"In Eclipse ThreadX 6.0.1 through 6.5.2.202603, a user-mode module can post a forged callback request to another module's queue. The receiving module calls the attacker-supplied function pointer without verifying the sender, so the attacker's code runs with that module's privilege.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["threadx","embedded","rtos","module-manager"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker code runs with privileged execution on the device","analyst_note":"Confirm the fixed version and any vendor advisory details (linked vendor advisory on github.com) and whether the flaw needs a non-default configuration.","how_to_check":"- Check whether the ThreadX version in use falls within `6.0.1` through `6.5.2.202603`.\n- Check whether the build uses the ThreadX Module Manager with memory-protected user-mode modules, and whether any receiving module runs in privileged mode.","plain_action":"","needs_analyst":true,"not_affected_if":["module-manager-unused","no-user-mode-modules"],"who_is_affected":"Systems built on Eclipse ThreadX's Module Manager with memory-protected user-mode modules are exposed. The risk is greatest where a receiving module runs in privileged mode. Teams not using the Module Manager or not running user-mode modules can likely skip it; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4202,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor advisory details (linked vendor advisory on github.com) and whether the flaw needs a non-default configuration.","search":"'-115231':15A,18A '-2026':14A,17A '6.0.1':30B,78C '6.5.2.202603':32B,80C 'access':12A 'anoth':45B,99C 'attack':55B,65B,128C 'attacker-suppli':54B 'call':52B,111C 'callback':42B,96C,102C,109C 'check':119C 'code':9A,67B,130C 'cve':13A,16A 'eclips':1A,28B,75C 'embed':20B 'execut':152C 'forg':41B,95C 'function':57B,113C 'gain':150C 'let':84C 'manag':23B,83C,123C 'memori':90C 'memory-protect':89C 'mode':5A,36B,88C,144C,148C 'modul':6A,22B,37B,46B,51B,71B,82C,92C,100C,107C,122C,135C,140C,149C 'module-manag':21B 'pointer':58B,114C 'post':39B,93C 'privileg':11A,73B,137C,143C,151C 'protect':91C 'queue':48B,104C 'receiv':50B,106C,134C 'request':43B,97C,103C,117C 'rtos':24B 'run':8A,68B,131C,141C 'runtim':25B 'sender':62B 'sent':124C 'suppli':56B 'thread':110C 'threadx':2A,19A,26B,29B,76C 'user':4A,35B,87C,147C 'user-mod':3A,34B,86C,146C 'verifi':60B 'version':77C 'without':59B,118C","nicknames":[],"mitigations":[],"who_affected":"Systems built on Eclipse ThreadX's Module Manager with memory-protected user-mode modules are exposed. The risk is greatest where a receiving module runs in privileged mode. Teams not using the Module Manager or not running user-mode modules can likely skip it; the sources do not say more.","tier":"B","verified":{"fix":{"at":"2026-11-03T09:21:11Z","by":"analyst","doc":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6","run_id":1472},"products":{"at":"2026-11-03T09:21:11Z","by":"analyst","doc":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6","run_id":1472}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["threadx"],"ptokens":["threadx"],"labels":["embedded","high","modulemanager","rtos","runtime","threadx"],"first_public_at":"2026-11-01T17:32:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115231","severity":null,"published_at":"2026-11-03T09:17:10+00:00","modified_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115231:1472","url":null,"severity":null,"published_at":"2026-11-03T09:21:11+00:00","modified_at":"2026-11-03T09:21:11+00:00","first_seen_at":"2026-11-03T09:21:11+00:00","fetched_at":"2026-11-03T09:21:11+00:00","note":"Read vendor release notes for v6.5.2.202603b (eclipse-threadx/threadx releases): fixed in 6.5.2.202603b, affects 6.0.1 through 6.5.2.202603, needs local code execution, not network reachable, no exploitation or PoC seen. GHSA page itself returned empty; advisory list confirms title and High rating. Did not check X."}],"documents":[{"id":56724,"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T17:32:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":3178,"url":"https://github.com/eclipse-threadx/threadx/releases","title":"ThreadX v6.5.2.202603b release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}