Eclipse Threadx vulnerabilities

6 CVEs affecting Eclipse Threadx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0648, published 2026-01-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-2212, published 2024-03-26. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compatibility_layers/FreeRTOS/tx_freertos.c) were missing…
CVE-2024-2214, published 2024-03-26. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. In Eclipse ThreadX before version 6.4.0, the _Mtxinit() function in the Xtensa port was missing an array size check causing a memory overwrite. The affected file was…
CVE-2025-55078, published 2025-10-14. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. In Eclipse ThreadX before version 6.4.3, an attacker can cause a denial of service (crash) by providing a pointer to a reserved or unmapped memory region. Vulnerable system calls had a check of…
CVE-2025-55079, published 2025-10-15. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. In Eclipse ThreadX before version 6.4.3, the thread module has a setting of maximum priority. In some cases the check of that maximum priority wasn't performed, allowing, as a result, to obtain a…
CVE-2025-55080, published 2025-10-15. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. In Eclipse ThreadX before 6.4.3, when memory protection is enabled, syscall parameters verification wasn't enough, allowing an attacker to obtain an arbitrary memory read/write.
CVE-2026-0648, published 2026-01-27. Medium severity, CVSS 6.3. EPSS: 0.1% chance of exploitation in the next 30 days. The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of…