An Eclipse ThreadX build that enables event tracing allows a user‑mode module marked with memory protection to register a global trace‑full callback function pointer. The kernel invokes this pointer directly when the trace buffer wraps, with no validation or trampoline. If the pointer points into the module’s own code, the kernel performs an unrestricted call from privileged code, enabling the module to execute arbitrary code with kernel privilege or, if the pointer is invalid, fault the kernel. The result is a denial of service that can be triggered by loading an arbitrary module and causing a trace‑buffer wrap.

Eclipse ThreadX is the affected product. Builds that compile with TX_ENABLE_EVENT_TRACE and that load user‑mode, memory‑protected modules (TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION) are vulnerable. All ThreadX versions from 6.0.1 through 6.5.2.202603 with the vulnerable configuration are affected.

The CVSS score of 8.5 reflects high severity, and the EPSS score of < 1% indicates a very low but nonzero exploitation probability, particularly for systems that permit privileged module loading. The vulnerability is not listed in the CISA KEV catalog. Exploitation is straightforward: a malicious module registers an untrusted trace‑full callback and triggers a trace‑buffer wrap, causing the kernel to execute the attacker’s code with kernel privileges or crash the system. The lack of validation in the kernel gives attackers with the ability to load modules repeated opportunities to gain kernel authority or bring the kernel down.