Threadx
Monthly
Secure memory disclosure in Eclipse ThreadX occurs because multiple TrustZone-M non-secure callable (NSC) entry functions fail to validate caller-supplied pointers, allowing code already executing in the non-secure world to hand the secure firmware pointers into secure memory that are then dereferenced without an NS-region check. Only builds that enable Arm TrustZone-M secure/non-secure separation and expose NSC entry points taking raw pointer arguments are exposed; a single-world ThreadX build without TrustZone-M NSC surfaces is not affected. Exploitation requires a local, already-established non-secure foothold (AV:L, PR:L) with no user interaction and no network vector, making this an access-gated trust-boundary flaw rather than an internet-facing critical, and no public exploit code has been identified at time of analysis.
Privilege escalation in Eclipse ThreadX allows an unprivileged, memory-protected ThreadX module to break out of its MPU isolation boundary and obtain privileged (kernel-mode) read and write access to arbitrary memory, including the ability to clear the MPU enable bit and remove its own protection. The attack is local and low-complexity and requires the attacker to already be able to execute code as a loaded, unprivileged module (PR:L), for example by supplying or subverting a loadable module in a deployment that uses the ThreadX Module feature with MPU-based memory protection; systems that do not use isolated modules are not affected. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the high integrity and confidentiality impact on isolated-module deployments makes it significant.
Memory corruption in ThreadX RTOS CreateCounter() function allows local attackers with user privileges to trigger hard faults or corrupt kernel memory by exhausting the counter pool, which causes an unchecked error code to be cast as a wild pointer. The vulnerability stems from incorrect error validation logic that fails to detect counter allocation failures, enabling subsequent writes to arbitrary memory addresses. No patch is currently available.
Insufficient validation of syscall parameters in Eclipse ThreadX before 6.4.3, when the memory-protection feature is enabled, allows a local attacker who already holds low-privilege code execution on the device - for example, control of a less-privileged ThreadX module - to craft system calls that escape intended isolation and obtain arbitrary memory read and write. The flaw is not remotely reachable on its own: it requires the non-universal memory-protection configuration, an existing foothold, and an exploitable syscall path, so this is a moderate, defense-in-depth vulnerability rather than an urgent, widely-exploitable priority. No public exploit identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
Eclipse ThreadX versions before 6.4.3 fail to enforce the configured maximum thread priority in certain thread-creation or priority-setting paths, allowing a local authenticated attacker who can invoke the relevant API to obtain a higher-priority thread than intended and cause a denial of service. The issue is fixed in ThreadX 6.4.3, and although publicly available exploit code exists, EPSS is low (0.17%, 6th percentile) and there is no confirmed active exploitation (no KEV). On flat-memory RTOS deployments the practical privilege boundary may be weaker, so firmware that permits semi-trusted components to create threads is more exposed.
Eclipse ThreadX releases prior to 6.4.3 contain an incomplete pointer-validation flaw that lets a module-level caller crash the system by passing a pointer into a reserved or unmapped memory region, producing a local denial of service. The affected system calls did perform a pointer check, but that check never confirmed the pointer lay outside the calling module's own memory region, so a malformed or hostile pointer slips past validation and triggers a fault. Exploitation is strictly local and requires the ThreadX loadable Modules feature to be in use plus pre-existing low-privilege code execution inside a module (PR:L) - devices built without the Modules feature are unaffected. There is no data disclosure or modification, only a crash, and a publicly available exploit code exists; EPSS is low at 0.17% (6th percentile) and there is no confirmed actively exploited (CISA KEV) status, making this a moderate-severity local DoS rather than a priority emergency.
In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c) were missing parameter. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Secure memory disclosure in Eclipse ThreadX occurs because multiple TrustZone-M non-secure callable (NSC) entry functions fail to validate caller-supplied pointers, allowing code already executing in the non-secure world to hand the secure firmware pointers into secure memory that are then dereferenced without an NS-region check. Only builds that enable Arm TrustZone-M secure/non-secure separation and expose NSC entry points taking raw pointer arguments are exposed; a single-world ThreadX build without TrustZone-M NSC surfaces is not affected. Exploitation requires a local, already-established non-secure foothold (AV:L, PR:L) with no user interaction and no network vector, making this an access-gated trust-boundary flaw rather than an internet-facing critical, and no public exploit code has been identified at time of analysis.
Privilege escalation in Eclipse ThreadX allows an unprivileged, memory-protected ThreadX module to break out of its MPU isolation boundary and obtain privileged (kernel-mode) read and write access to arbitrary memory, including the ability to clear the MPU enable bit and remove its own protection. The attack is local and low-complexity and requires the attacker to already be able to execute code as a loaded, unprivileged module (PR:L), for example by supplying or subverting a loadable module in a deployment that uses the ThreadX Module feature with MPU-based memory protection; systems that do not use isolated modules are not affected. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the high integrity and confidentiality impact on isolated-module deployments makes it significant.
Memory corruption in ThreadX RTOS CreateCounter() function allows local attackers with user privileges to trigger hard faults or corrupt kernel memory by exhausting the counter pool, which causes an unchecked error code to be cast as a wild pointer. The vulnerability stems from incorrect error validation logic that fails to detect counter allocation failures, enabling subsequent writes to arbitrary memory addresses. No patch is currently available.
Insufficient validation of syscall parameters in Eclipse ThreadX before 6.4.3, when the memory-protection feature is enabled, allows a local attacker who already holds low-privilege code execution on the device - for example, control of a less-privileged ThreadX module - to craft system calls that escape intended isolation and obtain arbitrary memory read and write. The flaw is not remotely reachable on its own: it requires the non-universal memory-protection configuration, an existing foothold, and an exploitable syscall path, so this is a moderate, defense-in-depth vulnerability rather than an urgent, widely-exploitable priority. No public exploit identified at time of analysis, and EPSS is low at 0.14% (3rd percentile).
Eclipse ThreadX versions before 6.4.3 fail to enforce the configured maximum thread priority in certain thread-creation or priority-setting paths, allowing a local authenticated attacker who can invoke the relevant API to obtain a higher-priority thread than intended and cause a denial of service. The issue is fixed in ThreadX 6.4.3, and although publicly available exploit code exists, EPSS is low (0.17%, 6th percentile) and there is no confirmed active exploitation (no KEV). On flat-memory RTOS deployments the practical privilege boundary may be weaker, so firmware that permits semi-trusted components to create threads is more exposed.
Eclipse ThreadX releases prior to 6.4.3 contain an incomplete pointer-validation flaw that lets a module-level caller crash the system by passing a pointer into a reserved or unmapped memory region, producing a local denial of service. The affected system calls did perform a pointer check, but that check never confirmed the pointer lay outside the calling module's own memory region, so a malformed or hostile pointer slips past validation and triggers a fault. Exploitation is strictly local and requires the ThreadX loadable Modules feature to be in use plus pre-existing low-privilege code execution inside a module (PR:L) - devices built without the Modules feature are unaffected. There is no data disclosure or modification, only a crash, and a publicly available exploit code exists; EPSS is low at 0.17% (6th percentile) and there is no confirmed actively exploited (CISA KEV) status, making this a moderate-severity local DoS rather than a priority emergency.
In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.
In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c) were missing parameter. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.