ThreadX security advisories

The table below lists published security advisories for ThreadX, newest first. Click a GHSA ID for full details.

Published	GHSA ID	CVE ID	Summary	Severity
2026‑10‑02	GHSA‑rrjj‑jwcw‑hvf8	CVE‑2026‑102757	Module Manager accepts unauthenticated kernel object pointers, allowing module-to-kernel privilege escalation	High
2026‑10‑02	GHSA‑rrg6‑24r9‑wqpm	CVE‑2026‑95111	Module queue front-send validates a word count as a byte count	Medium
2026‑10‑02	GHSA‑fvp6‑37q5‑c648	CVE‑2026‑95109	Cortex-A7 module data validation checks only the first address of a caller-supplied range	High
2026‑10‑02	GHSA‑9hhf‑6357‑hpgq	CVE‑2026‑95108	Deleting a user-mode module thread leaks its privileged kernel stack	Medium
2026‑10‑02	GHSA‑63qc‑jcr6‑qw6r	CVE‑2026‑95107	Module object allocation size overflow corrupts the manager object pool	High
2026‑10‑02	GHSA‑5w57‑xhwq‑v7wq	CVE‑2026‑94202	Module block-pool create validates two of the four parameter words it reads	Medium
2026‑10‑02	GHSA‑57mf‑w87f‑rq7m	CVE‑2026‑94192	Module object deallocation can free a live ThreadX kernel object	High
2026‑10‑02	GHSA‑39rx‑hq8c‑4px8	CVE‑2026‑94024	Module Manager object lookup validates one byte of a module’s search name	Medium
2026‑10‑02	GHSA‑36vf‑7cx6‑9f9j	CVE‑2026‑94023	Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion	Medium
2026‑01‑23	GHSA‑xj75‑fc68‑h4rw	CVE‑2026‑0648	Persistent Initialisation Pointer Corruption in the POSIX Compatibility Layer	High
2025‑10‑15	GHSA‑w8rw‑fqgj‑9r49	CVE‑2025‑55079	Module thread can get priority higer than txm_module_instance_maximum_priority	Medium
2025‑10‑15	GHSA‑76hh‑wrj5‑hr2v	CVE‑2025‑55080	Improper Parameter Check in ThreadX Syscall Implementation	High
2025‑10‑14	GHSA‑wcfg‑5jpf‑hhxq	CVE‑2025‑55078	A kernel object pointer validation flaw in ThreadX system calls allows attackers to supply pointers to reserved memory regions.	Medium
2024‑03‑26	GHSA‑vmp6‑qhp9‑r66x	CVE‑2024‑2214	Missing array size check in _Mtxinit() in the Xtensa port	High
2024‑03‑26	GHSA‑v9jj‑7qjg‑h6g6	CVE‑2024‑2212	Integer wraparounds, under-allocations, and heap buffer overflows in Eclipse ThreadX xQueueCreate() and xQueueCreateSet()	High
2023‑12‑03	GHSA‑p7w6‑62rq‑vrf9	CVE‑2023‑48693	Azure RTOS ThreadX Remote Code Execution Vulnerability	High

Published

GHSA ID

CVE ID

Summary

Severity

2026‑10‑02

GHSA‑rrjj‑jwcw‑hvf8

CVE‑2026‑102757

Module Manager accepts unauthenticated kernel object pointers, allowing module-to-kernel privilege escalation

High

2026‑10‑02

GHSA‑rrg6‑24r9‑wqpm