CVE-2026-113421

UNKNOWN 0.0

ThreadX Modules invokes trace-full callbacks after module unload

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged thread context after the module's code has been released, so a user-mode module can have its code run with kernel privileges after unload, or, once the memory is reused, redirect control flow or cause a fault.

CWE	CWE-416
Vendor	eclipse foundation
Product	eclipse threadx
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse threadx

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse threadx are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse ThreadX

6.0.1 ≤ 6.5.2.202603

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-8pgj-qvjv-j4fq gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/457

Credits

testacegi, alex16848