{"id":"CVE-2026-118052","title":"Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation","summary":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation ari…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-667","CWE-833"],"vendor":"Eclipse Foundation","product":"Eclipse ThreadX","affected":["eclipse_threadx >= 6.0.1 <= 6.5.2.202603"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T16:19:35.690129Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T16:19:56.290Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118052","references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-67ww-q8x2-g487"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/511"}],"tags":["cve.org"],"epss":0.00112,"epssPercentile":0.0137,"ingestedAt":"2026-11-05T19:30:42.708Z","slug":"CVE-2026-118052","body":"## Overview\n\nIn Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.\n\n## Affected\n\n- `eclipse_threadx >= 6.0.1 <= 6.5.2.202603`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}