Eclipse ThreadX: Use-after-free in Module Manager object deallocation
Summary
Eclipse ThreadX up to 6.5.1.202602a lets a module release kernel object control blocks through txm_module_object_deallocate while the kernel still uses them. A module with low privileges running on the device can trigger a privileged use-after-free. According to the advisory, integrity and availability are lost in every case, and if the freed memory is reused, confidentiality is lost as well.
Affected
- Eclipse ThreadX 6.0.1 to 6.5.1.202602a
- Unknown: releases before 6.0.1
Fixed in
- Eclipse ThreadX 6.5.2.202603 or later
Workaround
- No vendor workaround documented. Where the Module Manager is not used, the vendor states that the issue is not reachable.
- Firmware developers should check their own code for calls to txm_module_object_deallocate, which is deprecated.
Exploitation
- No known exploitation in the wild. CISA SSVC: exploitation none, automatable no.
- No public proof of concept found.
Our recommendation
- Ask device vendors whether their firmware includes ThreadX 6.0.1 to 6.5.1.202602a and request an update to 6.5.2.202603 or later.
- Track firmware updates for IoT, industrial and building-automation devices.
- Standard office IT (Windows, Microsoft 365, standard servers) is not affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-57mf-w87f-rq7m github.com
- ThreadX v6.5.2.202603 release notes github.com
- Eclipse ThreadX vendor release announcement github.com
- VulDB entry 422905 vuldb.com
- OpenCVE CVE-2026-94192 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:22.
Original description (NVD)
A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.