CVE-2026-95111

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes. The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied. A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.

• CWE-125
• CWE-131

• https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-rrg6-24r9-wqpm

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-95105Reliance on Obfuscation or Encryption of Security-Relevant I…8.2
• CVE-2026-95106Gitea accepted pushed Git trees containing two entries with …9.1
• CVE-2026-95107A ThreadX module chooses `object_size` when it calls `txm_mo…7
• CVE-2026-95108One logical thread of a user-mode ThreadX module costs the M…6.8
• CVE-2026-95109The Cortex-A7 MMU Modules port validates a caller-supplied b…8.5
• CVE-2026-9511A vulnerability was identified in Totolink CA750-PoE 6.2c.51…6.3
• CVE-2026-95112When processing issue and comment bodies, Gitea scanned the …6.5
• CVE-2026-95114libwebsockets contains an out-of-bounds read vulnerability i…7.5
• CVE-2026-95115Buffer Overflow vulnerability in libwebsockets main 106d542c…7.5
• CVE-2026-95116An issue in libming through 0.4.8 allows a remote attacker t…7.5
• CVE-2026-95117Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647…3.7
• CVE-2026-9512A security flaw has been discovered in Totolink CA750-PoE 6.…6.3