CVE-2026-115231
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode…
- Risk score
- 51/100
- CVSS
- 8.5 v4.0
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.5 high
References
Original description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.
Last activity 3 Nov 2026. Patch Forecast updates every hour.