The vulnerability allows a memory-protected user-mode module to forge a callback request targeting another module's callback queue. The receiving module’s callback thread executes the function pointer in the request without verifying that the Module Manager sent it, allowing the attacker’s code to run with the receiving module’s privilege. If that module operates with privileged rights, the attacker gains privileged execution, compromising the host’s integrity and confidentiality.

Eclipse ThreadX real-time operating system, versions 6.0.1 through 6.5.2.202603, as distributed by the Eclipse Foundation. The flaw resides within the Module Manager component that routes callback requests; any user‑mode or privileged module loaded into these releases can be affected.

The CVSS score of 8.5 reflects a high severity, and the vulnerability enables local privilege escalation without input verification. Although the EPSS score is not available, the absence of validation in a privileged callback routine suggests a high likelihood of exploitation, especially in environments where arbitrary user‑mode modules can be loaded. The issue is not yet listed in CISA’s KEV catalog, but its high severity warrants immediate attention.