eclipse threadx CVE-2026-102710 is a vulnerability in Eclipse Threadx
Published on September 29, 2026

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from privileged code when the trace buffer wraps. A malicious module can thereby run its own code with kernel privilege, defeating module isolation, or fault the kernel with an invalid pointer.

NVD

Vulnerability Analysis

CVE-2026-102710 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
TOTAL
Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE

Weakness Types

Improper Privilege Management

The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Untrusted Pointer Dereference

The program obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.


Products Associated with CVE-2026-102710

Want to know whenever a new CVE is published for Eclipse Threadx? stack.watch will email you.

Eclipse Threadx

Affected Versions

Eclipse Foundation Eclipse ThreadX: