The Core issue stems from an error in the CreateCounter function within the ThreadX OSEK compatibility layer. The function incorrectly checks for a zero counter ID to detect failures, while the underlying osek_get_counter function returns the value 12 (E_OS_SYS_STACK) on exhaustion. Because the error check never triggers, the code proceeds to treat the numeric error code as a pointer. Subsequent writes using this bogus pointer corrupt memory at addresses such as 0x0000000C or trigger immediate hard faults. An attacker can exploit this flaw by repeatedly requesting counters until the pool is depleted, forcing the defective branch and destabilising the system. The result is a functional denial of service or silent memory corruption that could affect integrity and availability of the host application.

All implementations of Eclipse ThreadX that include the ThreadX OSEK compatibility layer, as identified by the Eclipse Foundation. The specific code resides in the file threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c. Version details are not enumerated in the advisory, so any build incorporating this source should be considered vulnerable until a patch is applied.

The CVSS score of 7.8 marks this vulnerability as high severity. The EPSS score is listed as less than 1%, indicating that, as of the last assessment, exploitation attempts are very rare. The flaw has not been reported in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires triggering counter creation repeatedly—an action that can be performed by local or remote entities that can invoke the affected API. While there is no immediate capability for remote code execution, the ability to crash the system or corrupt memory presents a significant risk to critical embedded systems that rely on ThreadX for real‑time performance.