CVE-2026-94202: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX

The vulnerability CVE-2026-94202 in Eclipse ThreadX arises from an out-of-bounds read in the function _txm_module_manager_tx_block_pool_create_dispatch. The Module Manager's block-pool create dispatcher assumes that two ALIGN_TYPE words in an extra-parameter array provided by a memory-protected module lie within the module's data and accesses indices 0 through 3 of that array. One unverified word is read during a buffer check that uses index 1 as the pool start and index 2 as the length for range checking, causing an out-of-bounds read before the kernel service is reached. The other unverified word is read when building the service's argument list. This results in reading memory that the module does not own, potentially leading to information disclosure or instability. The affected function is located in common_modules/module_manager/inc/txm_module_manager_dispatch.h. The affected versions are >=6.0.1 and <=6.5.1.202602a. The CVSS 4.0 vector indicates local attack vector, low complexity, no privileges required beyond limited, no user interaction, and low impacts on confidentiality, integrity, and availability.

The out-of-bounds read vulnerability allows the validation code and service argument list construction to read memory outside the bounds of the module's data. This could lead to unintended information disclosure or cause instability in the system. The CVSS score of 4.8 reflects a medium impact with low confidentiality, integrity, and availability impacts. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Eclipse Foundation advisories for updates and apply patches once available. Until then, cautious use of affected versions is advised.