Memory Protection Flaw in Eclipse ThreadX Affects Module Threads

CVE-2026-115653

What is CVE-2026-115653?

Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 have a flaw in the PendSV handler of Cortex-M module ports that allows user-mode, memory-protected module threads to store data in privileged memory. The vulnerability arises because the stack pointer, which should be verified against the thread's dedicated stack, is not adequately checked. This oversight could permit a memory-protected module to write up to nine specified words into sensitive memory directly beneath any writable region and subsequently read the stored information. This presents a significant risk to data integrity and security.

References