# CVE-2026-113421: Eclipse ThreadX Modules use-after-free in trace-buffer callback

Source: https://junglewise.ai/threats/cve-2026-113421-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-threadx  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-113421 · Severity: info · Published 2026-11-03

Eclipse ThreadX is a real-time operating system kernel used in embedded and IoT devices. The Modules feature allows loading user-mode applications; if tracing is enabled, an unloaded module's callback can be invoked by the kernel with elevated privileges after the module code is freed from memory, allowing arbitrary code execution with kernel-level access or memory corruption.

Technologies: [Eclipse ThreadX](https://junglewise.ai/threats/technologies/threadx). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-113421 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113421 being exploited in the wild.

**How severe is CVE-2026-113421?** Informational severity, published 3 November 2026.

**Which products and versions are affected?** Eclipse ThreadX 6.0.1 through 6.5.2.202603.

**Is there a fix for CVE-2026-113421?** Yes: fixed in 6.5.2.202603b. Until then: Build without TX_ENABLE_EVENT_TRACE, disable event tracing at runtime on systems loading untrusted modules, or define TXM_TRACE_BUFFER_FULL_NOTIFY_CALL_NOT_USED when building the Module Manager to remove the service from the dispatch table. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113421 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-113421?** Check whether you run Eclipse ThreadX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.5.2.202603b

Build without TX_ENABLE_EVENT_TRACE, disable event tracing at runtime on systems loading untrusted modules, or define TXM_TRACE_BUFFER_FULL_NOTIFY_CALL_NOT_USED when building the Module Manager to remove the service from the dispatch table.

## Technical details

ThreadX Modules registers a user-mode module's trace-buffer-full callback globally but does not revoke it when the module is stopped and unloaded. On configurations with event tracing enabled and a kernel-owned trace buffer remaining active, a trace buffer wrap after module unload invokes the stale callback pointer in privileged thread context. This is a use-after-free vulnerability (CWE-416) triggered when the kernel generates trace events; the released module code can be re-executed with kernel privileges, or if memory is reused, cause control-flow hijacking or a fault.

## Affected products

- Eclipse ThreadX 6.0.1 through 6.5.2.202603

## Timeline

- 2026-11-01: disclosed
- 2026-11-03: advisory

## References

- [https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-8pgj-qvjv-j4fq](https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-8pgj-qvjv-j4fq)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/457](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/457)

## Related threats

- [Eclipse ThreadX Module Manager privilege escalation via forged callback](https://junglewise.ai/threats/cve-2026-115231-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)
- [Eclipse ThreadX Module Manager missing authorization in thread control](https://junglewise.ai/threats/cve-2026-115654-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)
- [Eclipse ThreadX Cortex-M stack pointer memory access in privileged mode](https://junglewise.ai/threats/cve-2026-115653-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)
- [Eclipse ThreadX Module Manager mutex deadlock in preamble size validation](https://junglewise.ai/threats/cve-2026-118052-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)
- [Eclipse ThreadX Cortex-A7 MMU Modules buffer validation bypass](https://junglewise.ai/threats/cve-2026-95109-the-cortex-a7-mmu-modules-port-validates-a-caller-supplied-buffer)