CVE-2025-55078Medium· 5.5▾ SunlitIn Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of pointers, but that check wasn't verifying whether the pointer is outside the module memory region.
threadx < 6.4.3Upgrade past the affected range:
threadx 6.4.3Connected by shared product, vendor, weakness, or advisory.
CVE-2025-55080High· 7.1In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.
CVE-2026-94192High· 8.5Module object deallocation can free a live ThreadX kernel object
CVE-2026-94023Medium· 6.9Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
CVE-2026-95109High· 8.5Cortex-A7 module data validation checks only the first address of a caller-supplied range
CVE-2026-94024Medium· 6.9Module Manager object lookup validates one byte of a module's search name
CVE-2026-95107High· 7.0Module object allocation size overflow corrupts the manager object pool