{"id":"CVE-2026-95111","kind":"vulnerability","aliases":["CVE-2026-95111"],"related":[],"title":"ThreadX: front-send queue check reads past module buffer in privileged mode","description":"A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes.\n\n\n\nThe front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied.\n\n\n\nA source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.","summary":"In memory-protected ThreadX modules, the front-send queue dispatcher passes a word count where a byte count is needed, so the range check accepts a source buffer too short for the copy. The privileged copy then reads several times the allowed length from memory outside the module's range, and the words land in the queue where the module can read them back.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","module-manager","rtos","threadx"],"not_affected_if":["no-memory-protected-modules","no-module-manager"],"how_to_check":"- unknown","fix":null,"status":"open","published_at":"2026-10-20T15:17:36+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:33:24+00:00","updated_at":"2026-10-25T04:33:24+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:33:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"ThreadX: front-send queue check reads past module buffer in privileged mode","impact":"medium","summary":"In memory-protected ThreadX modules, the front-send queue dispatcher passes a word count where a byte count is needed, so the range check accepts a source buffer too short for the copy. The privileged copy then reads several times the allowed length from memory outside the module's range, and the words land in the queue where the module can read them back.","category":"infrastructure","nicknames":[],"who_cares":["threadx","embedded","rtos","module-manager"],"confidence":0.6,"needs_auth":"unknown","worst_case":"privileged code reads out-of-range memory and leaks it through the queue","analyst_note":"Find the fixed ThreadX release and the affected version range from the NVD entry or the vendor advisory; the sources give neither.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-memory-protected-modules","no-module-manager"],"who_is_affected":"Embedded systems that run ThreadX with the memory-protected Module Manager and let a module send to queues with _txe_queue_front_send. Systems using ThreadX without the Module Manager, or without memory-protected modules, are not in the described code path. The sources do not name affected ThreadX versions or a patched release.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.0006,"input_tokens":3531,"output_tokens":493,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-95111':16A,19A '3':225C 'accept':53B,207C 'allow':70B,237C 'alway':190C 'area':249C 'back':92B,261C 'buffer':10A,56B,117C,194C 'byte':45B,163C,198C,219C,228C 'check':6A,52B,134C 'copi':61B,64B,121C,150C 'count':42B,46B,144C,172C 'cve':14A,17A 'decid':110C 'dispatch':38B,107C,168C 'either':181C 'embed':20B 'end':195C,231C 'extent':127C,157C 'front':3A,35B,166C,211C 'front-send':2A,34B,165C 'hand':125C 'header':188C 'infrastructur':21B 'land':82B 'layer':108C 'length':71B 'manag':24B,105C 'mani':153C 'may':122C,203C 'memori':29B,73B,95C,200C 'memory-protect':28B,94C 'messag':140C,159C,196C,215C,226C,248C 'mode':13A,224C 'modul':9A,23B,32B,76B,88B,98C,104C,115C,130C,202C,235C,252C 'module-manag':22B 'move':151C 'much':112C 'multipli':191C 'need':48B 'outsid':74B 'pass':39B,169C 'past':8A,229C 'port':131C 'privileg':12A,63B,119C,223C 'protect':30B,96C 'queue':5A,37B,85B,100C,120C,136C,139C,175C,179C,210C,246C,258C 'rang':51B,78B,133C 'reach':102C 'read':7A,66B,90B,204C,214C,239C,259C 'receiv':180C,255C 'request':101C 'rtos':25B 'send':4A,36B,167C,176C,212C 'sever':67B 'short':58B 'side':182C 'size':141C,160C,197C,216C,227C 'sizeof':161C,217C 'sourc':55B,193C 'therefor':206C 'threadx':1A,26B,31B,97C 'time':68B 'touch':123C 'tx':138C,174C,178C 'txe':209C 'ulong':146C,162C,218C 'word':41B,81B,154C,171C,241C 'written':243C","nicknames":[],"mitigations":[],"who_affected":"Embedded systems that run ThreadX with the memory-protected Module Manager and let a module send to queues with _txe_queue_front_send. Systems using ThreadX without the Module Manager, or without memory-protected modules, are not in the described code path. The sources do not name affected ThreadX versions or a patched release.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95111","severity":null,"published_at":"2026-10-20T15:17:36+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}