PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-95111 Eclipse Foundation CVE debrief

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes. The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied. A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.

Vendor
Eclipse Foundation
Product
Eclipse ThreadX
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for Eclipse ThreadX deployments should assess exposure and prioritize verification of the version in use. Defenders should also review and update affected versions to 6.5.2. 202603 or later. Additionally, defenders should monitor for potential buffer overflow attacks and verify the version of Eclipse ThreadX in use.

Why it matters

Defenders should prioritize verifying the version of Eclipse ThreadX in use and assessing exposure, as the vulnerability allows for a potential buffer overflow.

  • Potential buffer overflow attacks
  • Verification of Eclipse ThreadX version
  • Assessment of exposure in deployments

Technical summary

The vulnerability occurs in the Module Manager's dispatch layer, where a queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, but the front-send dispatcher passed the word count itself, leading to a potential buffer overflow. This issue allows for potential buffer overflow attacks. The vulnerability is caused by a missing multiplication of the `tx_queue_message_size` by the size of `ULONG`. A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read.

Defensive priority

Defenders should prioritize verifying the version of Eclipse ThreadX in use and assessing exposure, as the vulnerability allows for a potential buffer overflow.

Recommended defensive actions

  • Verify the version of Eclipse ThreadX in use and assess exposure
  • Review and update affected versions to 6.5.2. 202603 or later
  • Monitor for potential buffer overflow attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability occurs in the Module Manager's dispatch layer, where a queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, but the front-send dispatcher passed the word count itself, leading to a potential buffer overflow. Defenders should verify the version of Eclipse ThreadX in use and assess exposure. The source buffer ending `message_size` bytes into memory the module may A

Sources and references

Verified primary and authoritative sources

  • CVE-2026-95111 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-95111

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-95111 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-95111

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.