Description
A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes.



The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied.



A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.
Published: 2026-10-20
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Out-of-bounds read capable of leaking data beyond module buffer
Action: Assess Impact
AI Analysis

Impact

A ThreadX queue front‑send operation accepts a word count that is treated as a byte count, leading the privileged copy routine to read three times the intended number of bytes. The bug allows an executing module to read memory past the end of its allocated buffer, potentially exposing sensitive data or corrupting adjacent memory. The weakness matches CWE-125 (Out‑of‑bounds read) and CWE-131 (Incorrect calculation of buffer lengths).

Affected Systems

The flaw resides in the Eclipse ThreadX queue module and affects any installation of ThreadX that includes the queue front‑send functionality. No specific product versions are listed; the issue applies to all affected ThreadX builds that use the vulnerable dispatch logic.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker with the privilege to invoke tx_queue_front_send can cause a module to read memory beyond its allowed area; however, no public exploit has been reported and no exploitation pathway beyond a local, privileged context is described in the advisory.

Generated by OpenCVE AI on October 20, 2026 at 18:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch once released by Eclipse ThreadX
  • If a patch is not yet available, restrict or disable use of tx_queue_front_send in untrusted modules
  • Validate that message_size is measured in bytes and does not exceed the actual buffer size before queuing operations

Generated by OpenCVE AI on October 20, 2026 at 18:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes. The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied. A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.
Title Module queue front-send validates a word count as a byte count
Weaknesses CWE-125
CWE-131
References
Metrics cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-10-20T15:34:45.488Z

Reserved: 2026-09-23T13:43:25.627Z

Link: CVE-2026-95111

cve-icon Vulnrichment

Updated: 2026-10-20T15:34:40.727Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T15:17:36.900

Modified: 2026-10-20T19:48:50.250

Link: CVE-2026-95111

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T18:15:14Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-131

    Incorrect Calculation of Buffer Size