PT-2026-118438

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended txm module object pointer get...

PT-2026-118442

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TX THREAD control block through txm module object allocate; txm module manager thread create then takes a second allocation of TXM MODULE KERNEL STACK SIZ...

PT-2026-118440

The Module Manager's block-pool create dispatcher proved that two ALIGN TYPE words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer...