317 matches found
CVE-2026-95107
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
CVE-2026-95108
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...
CVE-2026-94192
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txmmoduleobjectdeallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is...
CVE-2026-94023
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for using an object, and using an object a module does not own is...
CVE-2026-95107
A vulnerability exists in ThreadX where a module chooses an object_size during a call to txm_module_object_allocate. The Module Manager appends a 16-byte private header to this size but fails to check for integer overflow . If the size is near the top of a ULONG, the addition wraps, causing the o...
CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
EUVD-2026-105151
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
CVE-2026-95108
A resource leak exists in ThreadX within the Module Manager component. When a user-mode module thread is deleted via the _txm_module_manager_tx_thread_delete_dispatch function, the dispatcher only releases the TX_THREAD control block but fails to release the associated privileged kernel stack all...
CVE-2026-95108 Deleting a user-mode module thread leaks its privileged kernel stack
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...
EUVD-2026-105149
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...
CVE-2026-95108 Deleting a user-mode module thread leaks its privileged kernel stack
One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...
EUVD-2026-105146
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for using an object, and using an object a module does not own is...
CVE-2026-94023 Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for using an object, and using an object a module does not own is...
CVE-2026-94023 Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion
A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for using an object, and using an object a module does not own is...
CVE-2026-94023
The ThreadX operating system contains a vulnerability in the Module Manager's dispatch layer . A module can access a kernel object's delete service because the dispatcher only checks if the object lies outside the module's own code and data; however, it fails to enforce kernel-object ownership be...
CVE-2026-95111
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...
CVE-2026-94192
The ThreadX kernel contains a vulnerability where a module can use txm_module_object_deallocate to return memory back to the Module Manager's object pool while the kernel is still using the associated control block. Because deallocation does not perform deletion, objects remain on active lists (s...
CVE-2026-94192 Module object deallocation can free a live ThreadX kernel object
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txmmoduleobjectdeallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is...
EUVD-2026-105144
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with txmmoduleobjectdeallocate. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is...