Heap Overflow in ThreadX Module of Eclipse ThreadX

CVE-2026-95107

What is CVE-2026-95107?

A vulnerability exists in the ThreadX module where the object size is improperly calculated due to a lack of verification when allocating memory. When the size parameter, combined with a private header added by the Module Manager, approaches the maximum value of a ULONG, it wraps around. This causes the allocated memory block to be smaller than needed, resulting in a potential heap overflow that can allow for unauthorized memory access and corruption of adjacent memory blocks.

References