Eclipse ThreadX ModMgr Priv Esc via forged callback (6.0.1-6.5.2.202603)
CVE-2026-115231 Published on November 3, 2026
User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.
Vulnerability Analysis
CVE-2026-115231 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-115231 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-115231
Want to know whenever a new CVE is published for Eclipse Threadx? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse ThreadX:- Version 6.0.1, <= 6.5.2.202603 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.