# CVE-2026-95109: Eclipse ThreadX Cortex-A7 MMU Modules buffer validation bypass

Source: https://junglewise.ai/threats/cve-2026-95109-the-cortex-a7-mmu-modules-port-validates-a-caller-supplied-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-95109 · Severity: info · Published 2026-10-20

Eclipse ThreadX is an embedded real-time operating system used in memory-protected applications. The Cortex-A7 MMU module port validates only the first byte of caller-supplied buffer ranges, allowing modules to read or write memory beyond what was checked. An attacker running module code can exploit this to access privileged data, corrupt memory, or trigger kernel faults.

Technologies: [Eclipse ThreadX](https://junglewise.ai/threats/technologies/threadx). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-95109 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95109 being exploited in the wild.

**How severe is CVE-2026-95109?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Eclipse ThreadX 6.1 through 6.5.1.202602a.

**Is there a fix for CVE-2026-95109?** Yes: fixed in ThreadX 6.5.2.202603. Until then: Integrators whose memory layout places unmapped guard pages after every module region can reduce confidentiality and integrity impact; availability impact remains. Disable TXM_MODULE_MEMORY_PROTECTION if memory-protected modules are not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95109 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-95109?** Check whether you run Eclipse ThreadX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ThreadX 6.5.2.202603

Integrators whose memory layout places unmapped guard pages after every module region can reduce confidentiality and integrity impact; availability impact remains. Disable TXM_MODULE_MEMORY_PROTECTION if memory-protected modules are not required.

## Technical details

The TXM_MODULE_MANAGER_CHECK_INSIDE_DATA macro in the Cortex-A7 MMU Modules port validates buffer access by translating only the start address via a single ATS1CUR instruction, ignoring the supplied buffer size and read/write intent. This allows a module to pass range checks for any buffer whose first byte is readable, even if subsequent bytes fall outside the module's mapped region. Privileged dispatch code then dereferences the entire unchecked range, enabling out-of-bounds read/write access by local module code with syscall capability.

## Affected products

- Eclipse ThreadX 6.1 through 6.5.1.202602a

## Timeline

- 2026-10-02: disclosed
- 2026-10-20: advisory
- 2026-10-20: patched: Version 6.5.2.202603 released

## References

- [https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-fvp6-37q5-c648](https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-fvp6-37q5-c648)

## Related threats

- [Eclipse ThreadX Module Manager privilege escalation via forged callback](https://junglewise.ai/threats/cve-2026-115231-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)
- [Eclipse ThreadX Modules use-after-free in trace-buffer callback](https://junglewise.ai/threats/cve-2026-113421-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-threadx)
- [Eclipse ThreadX Module Manager missing authorization in thread control](https://junglewise.ai/threats/cve-2026-115654-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)
- [Eclipse ThreadX Cortex-M stack pointer memory access in privileged mode](https://junglewise.ai/threats/cve-2026-115653-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)
- [Eclipse ThreadX Module Manager mutex deadlock in preamble size validation](https://junglewise.ai/threats/cve-2026-118052-in-eclipse-threadx-versions-6-0-1-through-6-5-2-202603-the)