Live › vulnerability › CVE-2026-115653
In Eclipse ThreadX 6.0.1 through 6.5.2.202603 on Cortex-M, the PendSV handler saves a preempted user-mode module thread's registers in privileged mode using an unchecked stack pointer. A memory-protected user-mode module can thereby write a few words into memory just below any region it may write, and read them back.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Embedded systems built on Eclipse ThreadX on Cortex-M microcontrollers that run user-mode, memory-protected modules. Systems that do not use ThreadX module support, or run only privileged code, are not exposed by this description. The sources do not state a fixed version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| threadx | vendor | >= 6.0.1, <= 6.5.2.202603 (Cortex-M module ports) | 6.5.2.202603b |
6.5.2.202603b (tag v6.5.2.202603b_rel), the hotfix release of 2026-11-01Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.
This page as .md · .json · in your agent: get_signal("CVE-2026-115653")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.