{"id":"CVE-2026-102711","aliases":["EUVD-2026-89174","GHSA-f53h-37j4-mqxx","GHSA-w4rq-vh43-v5q5"],"status":"published","title":"Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00077,"percentile":0.00104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-1284","CWE-345"],"published":"2026-09-29T17:38:22Z","modified":"2026-11-05T03:29:05Z","products":[{"vendor":"eclipse foundation","product":"eclipse threadx"}],"references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-f53h-37j4-mqxx","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102711","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w4rq-vh43-v5q5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102711.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-102711","title":"Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.","status":"published","published":"2026-09-29T17:38:22.171Z","modified":"2026-11-04T09:29:28.955Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-345","CWE-1284"],"updated_at":"2026-11-04T10:28:06.820135Z"}],"euvd":[{"id":"EUVD-2026-89174","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.","status":"published","published":"2026-09-29T17:38:22Z","modified":"2026-11-04T09:29:28Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-04T10:01:15.662689Z"}],"ghsa":[{"id":"GHSA-w4rq-vh43-v5q5","title":"Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker...","description":"Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_in_place_load` — APIs that take ONLY a base pointer, no image length, so every size/offset field in `TXM_MODULE_PREAMBLE` is fully attacker-trusted: (1) a heap OOB **read** (`code_size` trusted as the source-image length in the code-copy loop), and (2) a control-flow-integrity / defense-in-depth gap (module entry/start/callback/stop pointers computed as `code_start + preamble_offset` with only a `!= 0` check, and the preamble `checksum` never verified). No controlled OOB write was found (honest — the copy destination is overflow-guarded).","status":"published","published":"2026-09-29T18:32:00Z","modified":"2026-09-29T18:32:00Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:12:33.840327Z"}],"nvd":[{"id":"CVE-2026-102711","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.","status":"published","published":"2026-09-29T18:17:10.163Z","modified":"2026-11-04T10:17:23.353Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-125","CWE-345","CWE-1284"],"updated_at":"2026-11-04T11:59:36.745762Z"}],"osv":[{"id":"CVE-2026-102711","title":"Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.","status":"published","published":"2026-09-29T17:38:22.171Z","modified":"2026-11-05T21:31:40.236913024Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125","CWE-1284","CWE-345"],"updated_at":"2026-11-05T22:00:34.245765Z"}]}}