# CVE-2026-91041: Eclipse ThreadX FileX out-of-bounds heap write in fault-tolerant log replay

Source: https://junglewise.ai/threats/cve-2026-91041-mounting-an-attacker-controlled-fat-image-with-fault-tolerance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-91041 · Severity: high · CVSS 7.8 · Published 2026-10-20

FileX is a FAT filesystem library used in embedded systems. When fault tolerance is enabled, mounting a crafted FAT disk image triggers an out-of-bounds heap write that can overwrite the filesystem driver callback pointer, giving an attacker code execution on the device. This affects systems without memory protection, which is most embedded platforms.

Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-91041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91041 being exploited in the wild.

**How severe is CVE-2026-91041?** High severity, with a CVSS score of 7.8, published 20 October 2026.

**Which products and versions are affected?** Eclipse ThreadX FileX <= 6.5.1.202602.

**Is there a fix for CVE-2026-91041?** Yes: fixed in FileX 6.5.2.202603. Until then: Build without FX_ENABLE_FAULT_TOLERANT or do not call fx_fault_tolerant_enable() on any product that mounts media from untrusted sources. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91041 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-91041?** Check whether you run Eclipse ThreadX FileX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FileX 6.5.2.202603

Build without FX_ENABLE_FAULT_TOLERANT or do not call fx_fault_tolerant_enable() on any product that mounts media from untrusted sources.

## Technical details

The _fx_fault_tolerant_apply_logs function bounds a copy operation against the total sector cache size rather than the individual sector slot size, allowing an attacker-controlled log entry to write past its buffer and corrupt the adjacent FX_MEDIA driver callback. The write occurs during the same log replay iteration that calls the corrupted callback, completing the hijack in a single operation without address layout knowledge. Exploitation requires FX_ENABLE_FAULT_TOLERANT to be defined at build time and fx_fault_tolerant_enable() called at runtime, but also requires user interaction to mount the malicious filesystem.

## Affected products

- Eclipse ThreadX FileX <= 6.5.1.202602

## Timeline

- 2026-10-02: disclosed
- 2026-10-02: patched: FileX 6.5.2.202603 released
- 2026-10-20: advisory

## References

- [https://github.com/eclipse-threadx/filex/security/advisories/GHSA-c8cj-fj9j-426v](https://github.com/eclipse-threadx/filex/security/advisories/GHSA-c8cj-fj9j-426v)