Eclipse Foundation · product
Eclipse ThreadX
19 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.
- NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
- NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
- Deleting a user-mode module thread leaks its privileged kernel stack
- Module object allocation size overflow corrupts the manager object pool
- Module block-pool create validates two of the four parameter words it reads
- Cortex-A7 module data validation checks only the first address of a caller-supplied range
- Module object deallocation can free a live ThreadX kernel object
- Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
- Module queue front-send validates a word count as a byte count
- Module Manager object lookup validates one byte of a module's search name
- User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
- Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
- The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the retu…
- User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
- Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation
- ThreadX Modules invokes trace-full callbacks after module unload
- In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the n…
- In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protected module register any function pointe…
- Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.