---
id: CVE-2026-115231
title: >-
  User-mode module can post forged callback requests to another module's
  callback queue, running its code with that module's privilege
summary: >-
  In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager
  lets a user-mode, memory-protected module post a forged callback request to
  another module's callback request queue. The receiving module's callback
  thread calls …
severity: high
cvss: 8.5
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-269
  - CWE-862
vendor: Eclipse Foundation
product: Eclipse ThreadX
affected:
  - eclipse_threadx >= 6.0.1 <= 6.5.2.202603
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T20:09:07.982110Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:09:19.566Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115231'
references:
  - url: >-
      https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/484'
tags:
  - cve.org
epss: 0.00113
epssPercentile: 0.01441
ingestedAt: '2026-11-05T20:33:06.431Z'
---

## Overview

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.

## Affected

- `eclipse_threadx >= 6.0.1 <= 6.5.2.202603`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.