CVE-2026-113421High· 7.3▾ TwilightIn Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still activ…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.
eclipse_threadx >= 6.0.1 <= 6.5.2.202603Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115231High· 8.5User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
CVE-2026-115215High· 8.7NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
CVE-2026-115403High· 8.2NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
CVE-2026-118052Medium· 6.8Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation
CVE-2026-115653High· 7.0Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
CVE-2026-115654Medium· 6.9User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own