Eclipse ThreadX CVE-2026-102710

Exploitation requires ALL of: (1) firmware compiled with the TX_ENABLE_EVENT_TRACE build option (non-default), (2) a module loaded in TXM_MODULE_USER_MODE with TXM_MODULE_MEMORY_PROTECTION - i.e. the attacker already controls executing code inside a memory-protected user module, and (3) the trace buffer must wrap to trigger the callback (occurs during normal operation). The core weakness is that the module-registered global trace-full callback is invoked directly by privileged kernel code with no pointer validation and no privilege-dropping trampoline. Limiting factors: local access only (attacker must already run a loaded module), a non-default build flag, and the deployment model must permit loading of untrusted/third-party modules; devices without event tracing or without loadable user modules are not exploitable.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N with full VC/VI/VA:H and subsequent-system SC/SI/SA:H = 9.3) correctly models a user-mode-to-kernel privilege escalation: local vector, low privileges (a module must already be loaded and executing), and a scope-crossing impact where the compromised subsystem is the entire kernel. However, the raw 9.3 overstates real-world urgency because two significant preconditions gate exploitation and are not reflected in the base metrics: the firmware must be built with TX_ENABLE_EVENT_TRACE (non-default), and the attacker must already be running code inside a loaded TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION module - meaning this is a privilege-escalation primitive that presumes prior code execution, not an initial-access flaw. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input; the reporter's runtime register capture (CONTROL.nPRIV=0) confirms exploitability in a lab but is not released exploit code. Net: technically severe (defeats the core memory-protection guarantee of the module manager) but low likelihood of opportunistic mass exploitation - realistic risk is targeted, and confined to devices that both enable event tracing and load third-party/untrusted modules.

An attacker who can get a memory-protected user-mode module loaded onto a ThreadX device (built with event tracing enabled) registers a function pointer into its own code as the global trace-full callback. When the trace buffer wraps during normal operation, the kernel invokes that pointer directly from privileged context, executing the attacker's code with kernel privilege (CONTROL.nPRIV=0). No public exploit code exists, but the reporter confirmed the privileged execution at runtime.