CVE-2026-94024: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX
Description
The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended `txm_module_object_pointer_get_extended` is handed a length and does not use it to bound the buffer, and the deprecated `txm_module_object_pointer_get` supplies the largest value a `UINT` can hold, so it removes the bound rather than lacking one. A module can make the walk unbounded without knowing anything about the memory it reaches, and where the walk reaches memory a privileged read cannot take, the resulting fault leaves the kernel unable to preempt for the rest of the system's life. Vulnerable functions: `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch` (both in `common_modules/module_manager/inc/txm_module_manager_dispatch.h`) and `_txm_module_manager_object_name_compare` (`common_modules/module_manager/src/txm_module_manager_util.c`).
CVSS v4.0
Score 6.9medium
Affected software
Eclipse Foundation
Eclipse ThreadX
pkg:github/eclipse-threadx/threadxRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the Module Manager's object lookup functions in Eclipse ThreadX, specifically in `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch`, and `_txm_module_manager_object_name_compare`. These functions either do not properly bound the buffer length or use an excessively large length value, allowing a module to trigger an unbounded memory read in privileged mode with kernel preemption disabled. If the read accesses memory that cannot be privileged-read, it causes a fault that leaves the kernel unable to preempt, effectively halting system responsiveness.
Potential Impact
Successful exploitation can cause a kernel fault that disables preemption for the remainder of the system's uptime, potentially leading to system hangs or denial of service. The vulnerability requires privileged access and local vectoring, with low attack complexity and no user interaction needed. There is no indication of remote exploitation or code execution from the provided data.
Mitigation Recommendations
No official patch or fix information is provided in the vendor advisory or source data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running untrusted modules with privileged access or limit module loading to trusted sources to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-23T13:42:24.317Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad789f82cdf04f6563b84a8
Added to database: 10/20/2026, 15:34:16 UTC
Last enriched: 10/20/2026, 15:48:51 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.