CVE-2026-94202Module block-pool create validates two of the four parameter words it reads
Updated under an hour ago ()
Does this affect you?
It affects Eclipse Foundation Eclipse ThreadX. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer check, which takes index 1 as the pool start and index 2 as the length to range-check it over. So the out-of-bounds read is performed by the validation code itself, before the kernel service is reached, and the size the caller's pool start is then validated against is a word the manager has not proved the module owns. The other unproved word is read when the service's argument list is built. Vulnerable function: `_txm_module_manager_tx_block_pool_create_dispatch`, in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`.
- CVSS
- 4.8 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-125
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- eclipse
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 20, 2026
- First seen by InfoSec Signals
- Oct 20, 2026
Affected products
Eclipse Foundation Eclipse ThreadX eclipse_foundation:eclipse_threadx (from the name) | from 6.0.1 through 6.5.1.202602a; 6.5.2.202603 not affected | CNA record |
References
- https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-5w57-xhwq-v7wq
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.