The vulnerability resides in the Module Manager’s block‑pool create dispatcher, which verifies only two of the four parameter words supplied by a memory‑protected module. Because of this limitation, the dispatcher performs an out‑of‑bounds read using unverified words from the module’s extra‑parameter array. This read occurs during input validation before the kernel service is reached, enabling a local attacker that can load a crafted module to read protected system memory and potentially expose confidential data. The weakness corresponds to CWE‑125.

Eclipse ThreadX, versions not specified in the advisory.

The CVSS score of 4.8 indicates moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate exploitation potential. Exploitation requires the ability to load a memory‑protected module, a privilege typically held by administrators or firmware developers, so the risk is primarily local and dependent on the attacker’s ability to inject modules into the system.