Eclipse ThreadX module loader accepts module images without an explicit length and blindly trusts size and offset fields in the preamble. A crafted module can claim a larger code size than its actual image or place entry points outside the valid code area, which causes an out‑of‑bounds read that may expose data residing after the module image. If entry pointers are manipulated, control flow can be redirected to arbitrary memory, potentially allowing execution of malicious code.

Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 are affected when the module loader feature is enabled and dynamic modules are loaded. Installations that enable module loading without enforcing integrity or signing verification are vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1 percent suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or requires privileged access, as an attacker must supply a crafted module image to the loader; remote exploitation would need an ability to trigger a module load through exposed interfaces.