The vulnerability arises when a module's preamble specifies a data or stack size that overflows the arithmetic used for allocation. The Module Manager loader reports an error but leaves its internal mutex held. This means any subsequent module operations—loading, starting, stopping, or unloading—block indefinitely until the system is reset, resulting in a denial of service.

The flaw is present in Eclipse ThreadX from version 6.0.1 up through 6.5.2.202603, the operating system package provided by the Eclipse Foundation.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to load a module with an oversized preamble; such a condition typically requires local or privileged access to the system’s module loading mechanism.