Memory Validation Flaw in ThreadX Module Manager by Eclipse

CVE-2026-94202

What is CVE-2026-94202?

The ThreadX Module Manager contains a security vulnerability where improper memory validation can occur during the creation of block pools. Specifically, the _txm_module_manager_tx_block_pool_create_dispatch function fails to adequately verify certain parameters of the extra-parameter array supplied by memory-protected modules. This oversight allows for potential out-of-bounds memory access, as the validation code improperly reads words that have not been verified as belonging to the module. Consequently, this flaw creates an opportunity for unauthorized data access, potentially affecting system stability and security.

References