{"id":"CVE-2026-95107","revision":"2fc33f59bad54d62880c8901c19ef7b7","records":[{"revision":"2fc33f59bad54d62880c8901c19ef7b7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-95107","aliases":[],"title":"Module object allocation size overflow corrupts the manager object pool","description":"A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.","state":0,"publishedAt":"2026-10-20T15:20:15.011+00:00","modifiedAt":"2026-10-20T17:05:35.811+00:00","affected":[{"ecosystem":"Vendor product","name":"ThreadX","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Eclipse Foundation\",\n                    \"product\": \"Eclipse ThreadX\",\n                    \"packageName\": \"ThreadX\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.0.1\",\n                            \"lessThanOrEqual\": \"6.5.1.202602a\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"6.5.2.202603\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","score":7,"severity":"HIGH"}],"references":["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-63qc-jcr6-qw6r"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-95107","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-95107","identifiers":["CVE-2026-95107"]},"retained":false,"historicalAffected":[]}],"coverage":[]}