CVE-2026-115653: fallo de gravedad alta en Eclipse ThreadX
Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7epss 0.1%
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Eclipse Foundation · Eclipse ThreadXCVEs relacionadas — Eclipse ThreadX
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-115215HIGHNetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session poolEPSS 0.4%CVE-2026-115403HIGHNULL pointer dereference in the BSD raw IPv6 send path when the destination table is fullEPSS 0.3%CVE-2026-95108MEDIUMDeleting a user-mode module thread leaks its privileged kernel stackEPSS 0.2%CVE-2026-95107HIGHModule object allocation size overflow corrupts the manager object poolEPSS 0.2%CVE-2026-94202MEDIUMModule block-pool create validates two of the four parameter words it readsEPSS 0.2%CVE-2026-95109HIGHCortex-A7 module data validation checks only the first address of a caller-supplied rangeEPSS 0.1%