CVE-2026-94023: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX

The vulnerability arises because the ThreadX module's delete service checks only whether an object pointer lies outside the module's own code and data before allowing deletion. While using objects created by other modules is supported for sharing purposes, destroying such shared objects is not intended. The function txm_module_object_pointer_get_extended returns pointers to objects created by the application or other modules, enabling shared access. However, the privileged dispatcher does not enforce ownership checks when deleting objects, allowing a module to delete any object it has a pointer to, leading to an out-of-bounds read condition and potential unauthorized deletion.

An attacker with limited privileges (local access) can exploit this vulnerability to delete kernel objects that they do not own, potentially causing denial of service or destabilizing the system. The CVSS 4.0 score of 6.9 reflects a medium severity with local attack vector, low attack complexity, no user interaction, and high impact on integrity and availability. There is no indication of confidentiality impact or scope change.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted modules only and avoid running untrusted code with privileges that allow object deletion through the Module Manager's dispatch layer.