CVE-2026-113421

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-115231

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that th...

EUVD-2026-115717

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-113421 ThreadX Modules invokes trace-full callbacks after module unload

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-113421 ThreadX Modules invokes trace-full callbacks after module unload

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-113421

Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 are vulnerable to a Use After Free (CWE-416) issue within ThreadX Modules . The flaw occurs because the system fails to revoke a module's trace-buffer-full callback upon stopping and unloading the module. If event tracing is enabled and a kernel...

CVE-2026-115231 User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that th...

EUVD-2026-115718

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that th...

CVE-2026-115231 User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that th...

CVE-2026-115231

Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 are vulnerable to a flaw where the Module Manager allows a user-mode, memory-protected module to post a forged callback request to another module's request queue. Because the receiving module's callback thread executes the function pointer witho...

CVE-2026-115215

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote,...

CVE-2026-115403

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a...

EUVD-2026-115638

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote,...

CVE-2026-115215 NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote,...

CVE-2026-115215 NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote,...

CVE-2026-115215

Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a are vulnerable to a Denial of Service (DoS) via the NetX Secure DTLS server . The root cause is that the server allocates a session from a fixed pool for the first datagram from any unrecognized address and port before the cookie exchang...

CVE-2026-115403 NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a...

CVE-2026-115403 NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a...

CVE-2026-115403

Eclipse ThreadX NetX Duo (versions 6.0 through 6.5.2.202603a) built with BSD raw socket and IPv6 support contains a vulnerability where the IPv6 raw send path fails to verify if a destination-table entry was successfully added. If the destination table is full and an off-link destination is reach...

EUVD-2026-115644

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a...