Answer in brief
CVE-2026-115231 records a High severity (CVSS 8.5) vulnerability in User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege. The current sources do not mark it as known exploited. The current feed maps Eclipse Foundation/Eclipse ThreadX (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Eclipse Foundation/Eclipse ThreadX (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Eclipse Foundation/Eclipse ThreadXgeneric | >=6.0.1 <=6.5.2.202603 | Not reported |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 3, 2026
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that the Module Manager sent it, so the attacker's code runs with the receiving module's privilege; when that module runs in privileged mode, a user-mode module gains privileged execution.
Quoted source text, attributed separately from HOL analysis.