{"id":"CVE-2026-115653","kind":"vulnerability","aliases":["CVE-2026-115653"],"related":[],"title":"Eclipse ThreadX: user-mode module can write privileged memory via PendSV","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.","summary":"In Eclipse ThreadX 6.0.1 through 6.5.2.202603 on Cortex-M, the PendSV handler saves a preempted user-mode module thread's registers in privileged mode using an unchecked stack pointer. A memory-protected user-mode module can thereby write a few words into memory just below any region it may write, and read them back.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"threadx","fixed":["6.5.2.202603b"],"affected":">= 6.0.1, <= 6.5.2.202603 (Cortex-M module ports)","ecosystem":"vendor"}],"ecosystems":[],"tags":["cortex-m","embedded","rtos","runtime","threadx"],"not_affected_if":["no-user-mode-modules","non-cortex-m","versions-outside-range"],"how_to_check":"- Check your ThreadX version: 6.0.1 through 6.5.2.202603 are affected (the vendor says some ports are affected only from the release that introduced them). 6.5.2.202603b is fixed.\n- Applies only to Cortex-M module ports (ThreadX Modules) that run user-mode, memory-protected modules; check your build includes the Cortex-M module port files and the PendSV handler from them.\n- Needs code already running in a loaded module; not reachable over the network.","fix":"Upgrade Eclipse ThreadX to 6.5.2.202603b (tag v6.5.2.202603b_rel), the hotfix release of 2026-11-01. The vendor says the PendSV fix has a regression test run on QEMU only, not on hardware.","status":"open","published_at":"2026-11-02T16:17:28+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","triaged_at":"2026-11-02T16:26:41+00:00","updated_at":"2026-11-02T16:30:49+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-02T16:26:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Eclipse ThreadX: user-mode module can write privileged memory via PendSV","impact":"high","summary":"In Eclipse ThreadX 6.0.1 through 6.5.2.202603 on Cortex-M, the PendSV handler saves a preempted user-mode module thread's registers in privileged mode using an unchecked stack pointer. A memory-protected user-mode module can thereby write a few words into memory just below any region it may write, and read them back.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["threadx","embedded","cortex-m","rtos"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Privileged memory overwritten by a user-mode module, enabling further escalation.","analyst_note":"Find the fixed ThreadX release and the vendor advisory linked in the sources to confirm the fix version.","how_to_check":"- Check the ThreadX version in use: `6.0.1` through `6.5.2.202603` are affected.\n- Confirm the target is a Cortex-M port that uses user-mode memory-protected modules.\n- Look for `PendSV` handler code in the port files used by the build.","plain_action":"","needs_analyst":true,"not_affected_if":["no-user-mode-modules","non-cortex-m","versions-outside-range"],"who_is_affected":"Embedded systems built on Eclipse ThreadX on Cortex-M microcontrollers that run user-mode, memory-protected modules. Systems that do not use ThreadX module support, or run only privileged code, are not exposed by this description. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4222,"output_tokens":612,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed ThreadX release and the vendor advisory linked in the sources to confirm the fix version.","search":"'-115653':15A,18A '-2026':14A,17A '25':153C '6.0.1':30B,89C '6.5.2.202603':32B,91C 'address':116C 'back':84B,170C 'check':125C 'choos':151C 'cortex':21B,35B,98C 'cortex-m':20B,34B,97C 'cve':13A,16A 'eclips':1A,28B,86C 'eight':148C 'embed':23B 'float':156C 'floating-point':155C 'handler':39B,94C 'immedi':161C 'm':22B,36B,99C 'may':79B,166C 'memori':10A,60B,73B,138C,160C 'memory-protect':59B,137C 'mode':5A,45B,52B,64B,107C,114C,136C 'modul':6A,46B,65B,100C,108C,140C 'nine':146C 'pendsv':12A,38B,93C 'point':157C 'pointer':57B,123C,127C 'port':101C 'preempt':42B,104C 'privileg':9A,51B,113C 'protect':61B,139C 'read':82B,169C 'region':77B,164C 'regist':49B,111C 'rtos':24B 'runtim':25B 'save':40B,102C 'stack':56B,122C,132C 'state':158C 'store':173C 'taken':117C 'therebi':67B,142C 'thread':47B,109C,120C,130C 'threadx':2A,19A,26B,29B,87C 'uncheck':55B 'use':53B 'user':4A,44B,63B,106C,135C 'user-mod':3A,43B,62B,105C,134C 'version':88C 'via':11A 'without':124C 'word':71B,147C 'write':8A,68B,80B,143C,167C","nicknames":[],"mitigations":[],"who_affected":"Embedded systems built on Eclipse ThreadX on Cortex-M microcontrollers that run user-mode, memory-protected modules. Systems that do not use ThreadX module support, or run only privileged code, are not exposed by this description. The sources do not state a fixed version.","tier":"B","verified":{"fix":{"at":"2026-11-02T16:30:49Z","by":"analyst","doc":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-c38r-v552-gh5g","run_id":1400},"products":{"at":"2026-11-02T16:30:49Z","by":"analyst","doc":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-c38r-v552-gh5g","run_id":1400}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["threadx"],"ptokens":["threadx"],"labels":["cortexm","embedded","high","rtos","runtime","threadx"],"first_public_at":"2026-11-01T17:32:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115653","severity":null,"published_at":"2026-11-02T16:17:28+00:00","modified_at":"2026-11-02T16:17:28+00:00","first_seen_at":"2026-11-02T16:24:04+00:00","fetched_at":"2026-11-02T16:24:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115653:1400","url":null,"severity":null,"published_at":"2026-11-02T16:30:49+00:00","modified_at":"2026-11-02T16:30:49+00:00","first_seen_at":"2026-11-02T16:30:49+00:00","fetched_at":"2026-11-02T16:30:49+00:00","note":"Fix confirmed from vendor release notes v6.5.2.202603b listing CVE-2026-115653 (CVSS 7.0, CWE-787/822). Linked GHSA page could not be fetched; release notes used. No exploitation or PoC found; not searched on X given local-only, obscure issue."}],"documents":[{"id":52760,"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-c38r-v552-gh5g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T17:32:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":52873,"url":"https://github.com/eclipse-threadx/threadx/releases/tag/v6.5.2.202603b_rel","title":"Eclipse ThreadX v6.5.2.202603b release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}