{"id":"CVE-2026-94024","kind":"vulnerability","aliases":["CVE-2026-94024"],"related":[],"title":"Azure RTOS ThreadX: unbounded module object lookup in privileged mode","description":"The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one.\n\n\n\nA module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life.\n\n\n\nVulnerable functions: `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch` (both in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`) and `_txm_module_manager_object_name_compare` (`common_modules/module_manager/src/txm_module_manager_util.c`).","summary":"The ThreadX Module Manager's object lookup checks only one byte of a module's search name and then reads as many bytes as the module declares, in privileged mode. A module can make the read run past its buffer into memory the kernel cannot safely read, and the resulting fault can leave the kernel unable to preempt for the rest of the system's life.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","module-manager","rtos","threadx"],"not_affected_if":["no-module-manager","no-untrusted-modules"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:24+00:00","updated_at":"2026-10-25T03:40:24+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T03:40:24Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Azure RTOS ThreadX: unbounded module object lookup in privileged mode","impact":"high","summary":"The ThreadX Module Manager's object lookup checks only one byte of a module's search name and then reads as many bytes as the module declares, in privileged mode. A module can make the read run past its buffer into memory the kernel cannot safely read, and the resulting fault can leave the kernel unable to preempt for the rest of the system's life.","category":"infrastructure","nicknames":[],"who_cares":["threadx","embedded","rtos","module-manager"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel stops preempting, hanging the whole system after a fault","analyst_note":"Find the affected and fixed ThreadX versions and the upstream fix commit in the NVD entry and the Azure RTOS advisory; the sources given do not list them.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-module-manager","no-untrusted-modules"],"who_is_affected":"Systems running the ThreadX Module Manager with loadable modules, where a module can be loaded and call the object lookup dispatchers `txm_module_object_pointer_get_extended` or the deprecated `txm_module_object_pointer_get`. Systems that do not use the Module Manager or do not load untrusted modules are less exposed; the sources do not say which versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000628,"input_tokens":3603,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-94024':13A,16A 'affect':133C 'anyth':189C 'azur':1A 'bound':152C,175C 'buffer':63B,154C 'byte':34B,46B,98C 'cannot':68B,204C 'check':31B 'common':246C,255C 'compar':254C 'count':127C 'cve':11A,14A 'declar':50B,118C 'deprec':157C 'dispatch':131C,233C,243C 'embed':17B 'extend':141C,242C 'fault':74B,208C 'function':224C 'get':140C,162C,232C,241C 'hand':143C 'hold':170C 'infrastructur':18B 'kernel':67B,78B,124C,211C 'know':188C 'lack':178C 'largest':165C 'leav':76B,209C 'length':145C 'life':89B,222C 'lookup':7A,30B,95C,130C 'make':57B,183C 'manag':21B,27B,92C,227C,236C,251C 'mani':45B 'memori':65B,102C,192C,200C 'memory-protect':101C 'mode':10A,53B,121C 'modul':5A,20B,26B,37B,49B,55B,91C,104C,117C,137C,159C,181C,226C,229C,235C,238C,250C 'module-manag':19B 'modules/module_manager/inc/txm_module_manager_dispatch.h':247C 'modules/module_manager/src/txm_module_manager_util.c':256C 'much':112C 'name':40B,107C,253C 'object':6A,29B,94C,138C,160C,230C,239C,252C 'one':33B,97C,179C 'past':61B 'pointer':139C,161C,231C,240C 'preempt':81B,214C 'preemption':126C 'privileg':9A,52B,120C,202C 'protect':103C 'rais':128C 'rather':176C 'reach':194C,199C 'read':43B,59B,70B,203C 'recommend':135C 'remov':173C 'rest':84B,217C 'result':73B,207C 'rtos':2A,22B 'run':60B 'safe':69B 'search':39B,106C 'suppli':163C 'system':87B,220C 'take':205C 'threadx':3A,23B,25B 'txm':136C,158C,225C,228C,234C,237C,249C 'uint':168C 'unabl':79B,212C 'unbound':4A,186C 'use':149C 'valid':96C 'valu':166C 'vulner':223C 'walk':110C,185C,198C 'without':187C","nicknames":[],"mitigations":[],"who_affected":"Systems running the ThreadX Module Manager with loadable modules, where a module can be loaded and call the object lookup dispatchers `txm_module_object_pointer_get_extended` or the deprecated `txm_module_object_pointer_get`. Systems that do not use the Module Manager or do not load untrusted modules are less exposed; the sources do not say which versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94024","severity":null,"published_at":"2026-10-20T16:17:17+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}