Eclipse ThreadX: Out-of-bounds read and write via Cortex-A7 module data check
Summary
The Cortex-A7 MMU Modules port of Eclipse ThreadX validates a caller-supplied buffer by checking only its first byte, ignoring the range size. A module with ordinary system call access can therefore make privileged code read or write beyond the buffer it is allowed to use. Exploitation requires local access and a module already running on the device, and the flaw affects builds with TXM_MODULE_MEMORY_PROTECTION enabled.
Affected
- Eclipse ThreadX 6.1 up to and including 6.5.1.202602a (Cortex-A7 MMU Modules builds with GNU, AC5 or IAR toolchains and TXM_MODULE_MEMORY_PROTECTION)
- Other module ports are not affected according to the vendor advisory
Fixed in
- Fixed in ThreadX 6.5.2.202603
Workaround
Unknown.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in the CISA KEV catalog and no public proof of concept detected at the time of the search (aggregator data)
Our recommendation
- Ask device and OEM vendors whether their firmware uses ThreadX on Cortex-A7 with memory-protected modules
- Request a firmware version that includes ThreadX 6.5.2.202603 or later
- Until patched, restrict which modules can be loaded and review third-party module code
- Verify the affected builds in the vendor advisory GHSA-fvp6-37q5-c648
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fvp6-37q5-c648 github.com
- OSV record CVE-2026-95109 vulners.com
- OpenCVE CVE-2026-95109 app.opencve.io
- Strix CVE-2026-95109 www.strix.ai
- ThreatINT CVE-2026-95109 cve.threatint.com
- TheHackerWire CVE-2026-95109 www.thehackerwire.com
- ThreadX (Wikipedia) en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:22.
Original description (NVD)
The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start. A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.