The vulnerability arises in the ThreadX loadable-module loader's APIs `_txm_module_manager_memory_load` and `_txm_module_manager_in_place_load`, which accept only a base pointer and do not verify the image length. The `TXM_MODULE_PREAMBLE` structure's size and offset fields are fully attacker-controlled. This results in (1) a heap out-of-bounds read caused by using the `code_size` field as the source image length during code copying, and (2) a control-flow integrity weakness where module entry, start, callback, and stop pointers are computed as `code_start + preamble_offset` with only a non-zero check, and the preamble checksum is never verified. The copy destination is protected against overflow, so no out-of-bounds write was identified.

An attacker who can supply a malicious module to the loadable-module loader can cause a heap out-of-bounds read, potentially leaking memory contents. The control-flow integrity gap could allow bypassing some defense-in-depth mechanisms, but no direct code execution or write corruption was confirmed. The vulnerability requires local access (AV:L) and user interaction (UI:A), with high complexity and limited privileges, resulting in limited impact.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid loading untrusted modules via the affected APIs. Because the vulnerability requires local access and user interaction, restricting module loading to trusted sources reduces risk.