---
id: "CVE-2026-115653"
kind: "vulnerability"
aliases: ["CVE-2026-115653"]
title: "Eclipse ThreadX: user-mode module can write privileged memory via PendSV"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "threadx", "fixed": ["6.5.2.202603b"], "affected": ">= 6.0.1, <= 6.5.2.202603 (Cortex-M module ports)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cortex-m", "embedded", "rtos", "runtime", "threadx"]
not_affected_if: ["no-user-mode-modules", "non-cortex-m", "versions-outside-range"]
published_at: "2026-11-02T16:17:28+00:00"
first_seen_at: "2026-11-02T16:24:04+00:00"
updated_at: "2026-11-02T16:30:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115653", "first_seen_at": "2026-11-02T16:24:04+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T16:30:49+00:00"}]
---

# Eclipse ThreadX: user-mode module can write privileged memory via PendSV

In Eclipse ThreadX 6.0.1 through 6.5.2.202603 on Cortex-M, the PendSV handler saves a preempted user-mode module thread's registers in privileged mode using an unchecked stack pointer. A memory-protected user-mode module can thereby write a few words into memory just below any region it may write, and read them back.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:threadx affected >= 6.0.1, <= 6.5.2.202603 (Cortex-M module ports) fixed 6.5.2.202603b

## How to check

- Check your ThreadX version: 6.0.1 through 6.5.2.202603 are affected (the vendor says some ports are affected only from the release that introduced them). 6.5.2.202603b is fixed.
- Applies only to Cortex-M module ports (ThreadX Modules) that run user-mode, memory-protected modules; check your build includes the Cortex-M module port files and the PendSV handler from them.
- Needs code already running in a loaded module; not reachable over the network.

## Fix

Upgrade Eclipse ThreadX to 6.5.2.202603b (tag v6.5.2.202603b_rel), the hotfix release of 2026-11-01. The vendor says the PendSV fix has a regression test run on QEMU only, not on hardware.

## Timeline

- 2026-11-02T16:24:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115653
- 2026-11-02T16:30:49+00:00 analyst — Fix confirmed from vendor release notes v6.5.2.202603b listing CVE-2026-115653 (CVSS 7.0, CWE-787/822). Linked GHSA page could not be fetched; release notes used. No exploitation or PoC found; not searched on X given local-only, obscure issue.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-c38r-v552-gh5g
- [fix] Eclipse ThreadX v6.5.2.202603b release notes https://github.com/eclipse-threadx/threadx/releases/tag/v6.5.2.202603b_rel

## From the sources

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_