CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool

A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...

CVE-2026-95107

A vulnerability exists in ThreadX where a module chooses an object_size during a call to txm_module_object_allocate. The Module Manager appends a 16-byte private header to this size but fails to check for integer overflow . If the size is near the top of a ULONG, the addition wraps, causing the o...

CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool

A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...

CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool

A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...