CVE-2026-118052

medium

Description

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/511

https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-67ww-q8x2-g487

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-115230

Details

Source: Mitre, NVD

Published: 2026-11-02

Updated: 2026-11-02

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 6.8

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00112