An unprivileged module in Eclipse ThreadX can read and write memory at arbitrary addresses while in privileged mode, allowing it to disable the memory protection unit and lift its own isolation boundaries. The vulnerability stems from how the Module Manager verifies object addresses, permitting a module to pass an address that appears within a privileged allocation but is actually an arbitrary location. By exploiting this flow, an attacker can direct privileged services to perform memset over a chosen range, effectively erasing or corrupting memory and gaining control of the kernel space. This flaw gives an attacker the capability to read or overwrite data at will, which can lead to arbitrary code execution or complete takeover of the running system.

All deployments of Eclipse ThreadX that have not applied the patch referenced in the advisory. The issue affects modules that rely on the Module Manager for privilege checks, without any version restrictions noted in the available data.

The CVSS base score of 8.5 indicates high severity, while the EPSS metric is not available, implying no current data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw implies it could be leveraged by an attacker with local or compromised process access. Exploitation requires understanding or manipulating the module’s internal memory structures, which suggests a sophisticated attacker. Nevertheless, the ability to clear the MPU enable bit removes all memory isolation, elevating the risk to full system compromise.