CVE Tools
Track your stack

Eclipse Threadx

19 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Eclipse Threadx, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Eclipse Threadx CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Eclipse Threadx CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-011
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-092
2026-108
2026-118

Severity

How the 19 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • High1100%

Latest CVEs

The 15 most recently published vulnerabilities affecting Eclipse Threadx.

  1. CVE-2026-113421ThreadX Modules invokes trace-full callbacks after module unload—
  2. CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege—
  3. CVE-2026-115215NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool—
  4. CVE-2026-115403NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full—
  5. CVE-2026-115654User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own—
  6. CVE-2026-115653Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode—
  7. CVE-2026-114408NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full—
  8. CVE-2026-118052Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation—
  9. CVE-2026-95107Module object allocation size overflow corrupts the manager object pool—
  10. CVE-2026-94202Module block-pool create validates two of the four parameter words it reads—
  11. CVE-2026-95108Deleting a user-mode module thread leaks its privileged kernel stack—
  12. CVE-2026-94024Module Manager object lookup validates one byte of a module's search name—
  13. CVE-2026-94023Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion—
  14. CVE-2026-95109Cortex-A7 module data validation checks only the first address of a caller-supplied range—
  15. CVE-2026-94192Module object deallocation can free a live ThreadX kernel object—

Product grouping is registry-driven, with AI assist and human review. How it works