---
id: "CVE-2026-94024"
kind: "vulnerability"
aliases: ["CVE-2026-94024"]
title: "Azure RTOS ThreadX: unbounded module object lookup in privileged mode"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["embedded", "infrastructure", "module-manager", "rtos", "threadx"]
not_affected_if: ["no-module-manager", "no-untrusted-modules"]
published_at: "2026-10-20T16:17:17+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:40:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94024", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Azure RTOS ThreadX: unbounded module object lookup in privileged mode

The ThreadX Module Manager's object lookup checks only one byte of a module's search name and then reads as many bytes as the module declares, in privileged mode. A module can make the read run past its buffer into memory the kernel cannot safely read, and the resulting fault can leave the kernel unable to preempt for the rest of the system's life.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94024

## From the sources

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one.



A module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life.



Vulnerable functions: `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch` (both in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`) and `_txm_module_manager_object_name_compare` (`common_modules/module_manager/src/txm_module_manager_util.c`).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_