Skip to content
Eclipse Foundation Threadx vulnerabilities
-
eclipse foundation threadx
ThreadX Modules invokes trace-full callbacks after module unload
CVE-2026-113421
7.3 High
-
eclipse foundation threadx
User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
CVE-2026-115231
8.5 High
-
eclipse foundation threadx
NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
CVE-2026-115215
8.7 High
-
eclipse foundation threadx
NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
CVE-2026-115403
8.2 High
-
eclipse foundation threadx
User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
CVE-2026-115654
6.9 Medium
-
eclipse foundation threadx
Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
CVE-2026-115653
7.0 High
-
eclipse foundation threadx netx duo
NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full
CVE-2026-114408
8.7 High
-
eclipse foundation threadx
Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation
CVE-2026-118052
6.8 Medium
-
eclipse foundation threadx - netx duo
NetX Duo Web HTTP server interprets request body content as HTTP header fields
CVE-2026-93003
6.9 Medium
-
eclipse foundation threadx
Module object allocation size overflow corrupts the manager object pool
CVE-2026-95107
7.0 High
-
eclipse foundation threadx
Module block-pool create validates two of the four parameter words it reads
CVE-2026-94202
4.8 Medium
-
eclipse foundation threadx
Deleting a user-mode module thread leaks its privileged kernel stack
CVE-2026-95108
6.8 Medium
-
eclipse foundation threadx
Module Manager object lookup validates one byte of a module's search name
CVE-2026-94024
6.9 Medium
-
eclipse foundation threadx
Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
CVE-2026-94023
6.9 Medium
-
eclipse foundation threadx
Cortex-A7 module data validation checks only the first address of a caller-supplied range
CVE-2026-95109
8.5 High
-
eclipse foundation threadx
Module object deallocation can free a live ThreadX kernel object
CVE-2026-94192
8.5 High
-
eclipse foundation threadx - netx duo
Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
CVE-2026-92843
8.7 High
-
eclipse foundation threadx - netx duo
NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
CVE-2026-94018
8.8 High
-
eclipse foundation threadx - netx duo
Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
CVE-2026-92853
8.7 High
-
eclipse foundation threadx - netx duo
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
CVE-2026-93475
9.3 Critical
-
eclipse foundation threadx - guix
Out-of-bounds read when a multi-line text view string ends with a carriage return
CVE-2026-91057
4.6 Medium
-
eclipse foundation threadx - guix
JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
CVE-2026-92454
6.8 Medium
-
eclipse foundation threadx - guix
JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
CVE-2026-91059
6.8 Medium
-
eclipse foundation threadx - guix
GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
CVE-2026-91189
7.1 High
-
eclipse foundation threadx - guix
GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
CVE-2026-92446
6.8 Medium
-
eclipse foundation threadx - guix
Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
CVE-2026-92449
6.8 Medium
-
eclipse foundation threadx - guix
PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
CVE-2026-91186
8.4 High
-
eclipse foundation threadx
Module queue front-send validates a word count as a byte count
CVE-2026-95111
4.8 Medium
-
eclipse foundation threadx - usbx
USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
CVE-2026-96402
5.2 Medium
-
eclipse foundation threadx - usbx
VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
CVE-2026-96406
4.9 Medium
-
eclipse foundation threadx - usbx
Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
CVE-2026-96582
4.9 Medium
-
eclipse foundation threadx - filex
FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
CVE-2026-91041
7.8 High
-
eclipse foundation threadx netx duo
Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server
CVE-2026-106465
6.9 Medium
-
eclipse foundation threadx netx duo
Out-of-bounds read via an empty signature BIT STRING in NetX Secure X.509 parsing
CVE-2026-106464
8.7 High
-
eclipse foundation threadx - netx duo
Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of…
CVE-2026-103416
9.3 Critical
-
eclipse foundation threadx netx duo
Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX
CVE-2026-102730
8.6 High
-
eclipse foundation threadx netx duo
FTP Passive Data Connection Not Bound to the Authenticated Control Peer
CVE-2026-102727
6.0 Medium
-
eclipse foundation threadx netx duo
Out-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)
CVE-2026-102728
6.3 Medium
-
eclipse foundation threadx netx duo
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
CVE-2026-102726
7.1 High
-
eclipse foundation threadx netx duo
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
CVE-2026-102725
7.1 High
-
eclipse foundation threadx netx duo
NULL pointer dereference when evicting the last MSRP attribute in a participant's list
CVE-2026-102724
7.1 High
-
eclipse foundation threadx netx duo
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
CVE-2026-102723
7.1 High
-
eclipse foundation threadx netx duo
The FTP client trusts arbitrary IP addresses in the PASV server response
CVE-2026-102722
6.9 Medium
-
eclipse foundation threadx netx duo
TFTP client and server copy the ERROR packet message without bounding the read against the packet
CVE-2026-102721
6.9 Medium
-
eclipse foundation threadx netx duo
DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer
CVE-2026-102720
5.3 Medium
-
eclipse foundation threadx netx duo
NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check
CVE-2026-102719
6.3 Medium
-
eclipse foundation threadx netx duo
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
CVE-2026-102718
Public exploit
8.7 High
-
eclipse foundation threadx netx duo
A malformed Session header permanently orphans one packet-pool block per RTSP request
CVE-2026-102716
8.7 High
-
eclipse foundation threadx netx duo
mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
CVE-2026-102715
7.1 High
-
eclipse foundation threadx netx duo
ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanen…
CVE-2026-102714
7.1 High
- Show olderLoading…