The vulnerability lies in the Module Manager lookup routines of Eclipse ThreadX, where only a single byte of a module’s search name is validated. The lookup dispatchers walk the full module name in privileged mode without applying the provided length bound. This unbounded access can cause a privileged read fault that leaves the kernel unable to preempt, effectively rendering the system inoperative. The flaw is a buffer over-read and logical error that leads to a denial of service by crashing the kernel rather than permitting arbitrary code execution.

Eclipse Foundation’s Eclipse ThreadX. No specific version ranges are supplied in the advisory; any build that incorporates the affected lookup functions – namely `_txm_module_manager_txm_module_object_pointer_get_dispatch`, `_txm_module_manager_txm_module_object_pointer_get_extended_dispatch`, and `_txm_module_manager_object_name_compare` – is vulnerable.

The CVSS score of 6.9 indicates a moderate severity, and the advisory notes that the flaw is not listed in the CISA KEV catalog and there is no EPSS data available. The lack of a bounding check means the exploit requires the ability to trigger the object lookup with an attacker‑controlled module name. This typically requires kernel‑privileged actions such as loading a malicious module, so the attack surface is limited to systems that allow untrusted module loading or contain vulnerable development environments. The impact is a permanent kernel failure, which is a high‑consequence outcome, and the exploitability is moderate given the privileged context needed.