CVE-2026-95107

A vulnerability exists in ThreadX where a module chooses an object_size during a call to txm_module_object_allocate. The Module Manager appends a 16-byte private header to this size but fails to check for integer overflow . If the size is near the top of a ULONG, the addition wraps, causing the o...