Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
Affects Eclipse ThreadX 6.0.1 through 6.5.2.202603 on Cortex-M0+, M3, M4, M7, M23 or M33 ports using the Module Manager with user-mode modules. Fixed in 6.5.2.202603b.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 6.5.2.202603b
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Cortex-M module port (Cortex-M0+, M3, M4, M7, M23 or M33) with the Module Manager A user-mode, memory-protected module is loaded and controlled by the attacker Affected ThreadX versions 6.0.1 through 6.5.2.202603
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 12/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 6.5.2.202603b
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Eclipse ThreadX real-time operating system's Cortex-M module ports are affected, allowing a user-mode, memory-protected module to write to and read back memory outside its permitted regions. This could let a malicious or faulty module overwrite or read data belonging to the kernel or other modules, compromising isolation and system security.
Read the original description
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words, eight of its choosing, or 25 with floating-point state, into memory immediately below any region it may write, and read back what is stored there.
What to do
Check whether your setup matches what the bug needs.
Cortex-M module port (Cortex-M0+, M3, M4, M7, M23 or M33) with the Module Manager A user-mode, memory-protected module is loaded and controlled by the attacker Affected ThreadX versions 6.0.1 through 6.5.2.202603Upgrade to a fixed version: 6.5.2.202603b.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Eclipse Foundation Eclipse ThreadX
From 6.0.1 · through 6.5.2.202603
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-115653
What does this mean?
When a user-mode module's thread is preempted, the Cortex-M module port saves its registers through the module's stack pointer without checking it, while the CPU is in privileged mode. A user-mode module can therefore write chosen words, including an EXC_RETURN value, into memory it is not permitted to access, and read back what is stored there. This can lead PendSV to branch to an attacker-chosen value.Source: github.com
Am I affected, and how do I check?
Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 are affected on Cortex-M module ports when the Module Manager is used with user-mode, memory-protected modules. The advisory's quoted text names the Cortex-M3 and M4 IAR ports and the Cortex-M7 AC5 and IAR ports. To check, look at the ThreadX version in use and whether the Module Manager is in use.Source: github.com
What should I do about it?
Upgrade to ThreadX 6.5.2.202603b, which contains the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data