CVE-2026-95111: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX

The vulnerability involves a memory-protected ThreadX module's queue request reaching the Module Manager's dispatch layer, which determines the allowed buffer extent for privileged queue copying. The queue's message size is counted in ULONG units, and the copy operation moves that many words. However, the front-send dispatcher erroneously passed the word count directly without multiplying by sizeof(ULONG), unlike related functions tx_queue_send and tx_queue_receive. Consequently, _txe_queue_front_send reads three times the intended number of bytes past the allowed memory boundary in privileged mode, writing these out-of-bounds bytes into the queue's message area. A module receiving from this queue can then read these unintended bytes, causing an out-of-bounds read (CWE-125).

This vulnerability allows a privileged module to read memory beyond its authorized buffer, potentially exposing sensitive data or causing undefined behavior. The CVSS vector indicates local attack vector with low complexity, requiring low privileges and no user interaction. The impact is limited to information disclosure or memory corruption within the local system context.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running untrusted or less-trusted modules with privileged queue access, and monitor for updates from the Eclipse Foundation regarding patches or mitigations.