8 matches found
CVE-2026-95107
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
EUVD-2026-105151
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
CVE-2026-95107
A vulnerability exists in ThreadX where a module chooses an object_size during a call to txm_module_object_allocate. The Module Manager appends a 16-byte private header to this size but fails to check for integer overflow . If the size is near the top of a ULONG, the addition wraps, causing the o...
CVE-2026-95107
A ThreadX module chooses "objectsize" when it calls "txmmoduleobjectallocate". The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a "ULONG" wrapped, the pool served a block far smaller...
CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
CVE-2026-95107 Module object allocation size overflow corrupts the manager object pool
A ThreadX module chooses objectsize when it calls txmmoduleobjectallocate. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result without checking the addition. A size near the top of a ULONG wrapped, the pool served a block far smaller than t...
Eclipse ThreadX numeric error vulnerability
A security vulnerability exists in Eclipse ThreadX versions 6.0.1 through 6.5.1.202602a. It stems from the failure to validate the addition of a 16-byte private header to objectsize when calling txmmoduleobjectallocate; this results in an overflow of the ULONG value and enables out-of-bounds writ...