Eclipse ThreadX FileX: Out-of-bounds write in fault-tolerant log replay

Summary

Eclipse ThreadX FileX, an embedded FAT file system library, contains an out-of-bounds heap write during fault-tolerant log replay. An attacker who can present a crafted FAT image, for example via removable media, can write attacker-chosen data past the sector buffer, which may lead to code execution on devices without MMU, ASLR or W^X protections. The flaw only applies when FX_ENABLE_FAULT_TOLERANT is built in and fx_fault_tolerant_enable() is called at runtime.

Affected

• Eclipse ThreadX FileX versions up to and including 6.5.1.202602
• Only builds with FX_ENABLE_FAULT_TOLERANT enabled and fault tolerance activated at runtime

Fixed in

• Fixed in FileX 6.5.2.202603 (use this version or later)

Workaround

• Build FileX without FX_ENABLE_FAULT_TOLERANT, or do not call fx_fault_tolerant_enable(), on products that mount media they do not control
• Disabling fault tolerance is only possible if the product does not depend on it; this is not confirmed in the vendor advisory

Exploitation

• CISA SSVC: exploitation none, automatable no
• Not listed in CISA KEV
• No public proof-of-concept or in-the-wild exploitation known; this is not confirmed absent

Our recommendation

• Identify devices or firmware that use FileX, especially IoT, industrial or medical devices
• Check whether fault tolerance is enabled in the build and at runtime
• Obtain firmware based on FileX 6.5.2.202603 or later from the device vendor and update
• Until patched, restrict untrusted removable media on affected devices
• Low priority for typical office IT; the attack is local and requires user interaction

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-c8cj-fj9j-426v github.com
• FileX release v6.5.2.202603_rel github.com
• FileX pull request 111 github.com
• ST wiki: Introduction to FILEX wiki.st.com
• OpenCVE CVE-2026-91041 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:34.