CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege

Açıklama

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-q2rc-f35r-2hw6
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/484