The Cortex‑A7 MMU modules only validate the first byte of a caller‑supplied buffer, discarding the supplied size. This allows a privileged dispatcher to read or write beyond the intended range, corrupting memory. The flaw represents out‑of‑bounds read (CWE‑125) and write (CWE‑787) weaknesses. Because the primitive is invoked by every protected‑module dispatcher, an attacker who can supply a malicious range gains arbitrary read/write access that can lead to code execution or data exfiltration.

Vendor Eclipse ThreadX, product Eclipse ThreadX. No specific affected releases are listed; if your build incorporates the Cortex‑A7 MMU modules, it is likely vulnerable until a patch is applied. Check the vendor’s advisory for the first fix release.

The CVSS score of 8.5 denotes high severity. No EPSS score is provided, so the current exploitation probability cannot be quantified, but the flaw exists in a core primitive used by many components, raising its impact. The vulnerability is not listed in CISA KEV, yet it can be exercised locally by privileged code or, if an attacker can influence threadx services, remotely. The required fix is a complete validation of the buffer size before accessing it, which is absent in the current implementation.