CVE-2026-113421: Eclipse ThreadX Modules use-after-free in trace-buffer callback

CVE-2026-113421 · Severity: info · Published 2026-11-03

Eclipse ThreadX is a real-time operating system kernel used in embedded and IoT devices. The Modules feature allows loading user-mode applications; if tracing is enabled, an unloaded module's callback can be invoked by the kernel with elevated privileges after the module code is freed from memory, allowing arbitrary code execution with kernel-level access or memory corruption.

Technologies: Eclipse ThreadX. Vendors: Eclipse.

Quick answers

Is CVE-2026-113421 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-113421 being exploited in the wild.
How severe is CVE-2026-113421?
Informational severity, published 3 November 2026.
Which products and versions are affected?
Eclipse ThreadX 6.0.1 through 6.5.2.202603.
Is there a fix for CVE-2026-113421?
Yes: fixed in 6.5.2.202603b. Until then: Build without TX_ENABLE_EVENT_TRACE, disable event tracing at runtime on systems loading untrusted modules, or define TXM_TRACE_BUFFER_FULL_NOTIFY_CALL_NOT_USED when building the Module Manager to remove the service from the dispatch table. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113421 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-113421?
Check whether you run Eclipse ThreadX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 6.5.2.202603b

Build without TX_ENABLE_EVENT_TRACE, disable event tracing at runtime on systems loading untrusted modules, or define TXM_TRACE_BUFFER_FULL_NOTIFY_CALL_NOT_USED when building the Module Manager to remove the service from the dispatch table.

Technical details

ThreadX Modules registers a user-mode module's trace-buffer-full callback globally but does not revoke it when the module is stopped and unloaded. On configurations with event tracing enabled and a kernel-owned trace buffer remaining active, a trace buffer wrap after module unload invokes the stale callback pointer in privileged thread context. This is a use-after-free vulnerability (CWE-416) triggered when the kernel generates trace events; the released module code can be re-executed with kernel privileges, or if memory is reused, cause control-flow hijacking or a fault.

Affected products

  • Eclipse ThreadX 6.0.1 through 6.5.2.202603

Timeline

  • 2026-11-01: disclosed
  • 2026-11-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.