{"id":"CVE-2026-118052","aliases":[],"cve":{"records":[{"id":"CVE-2026-118052","source":"eclipse","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T15:19:03.736Z","published":"2026-11-02T14:57:27.483Z","modified":"2026-11-02T16:19:56.290Z"}],"publishers":[{"name":"eclipse","role":"CNA","organizationId":"e51fbebd-6053-4e49-959f-1b94eeb69a2c","modified":"2026-11-02T14:57:27.483Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-02T16:19:56.290Z"}],"references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-67ww-q8x2-g487","tags":[],"source":"eclipse"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/511","tags":[],"source":"eclipse"}],"weaknesses":[{"id":"CWE-667","description":"CWE-667 Improper Locking","source":"eclipse"},{"id":"CWE-833","description":"CWE-833 Deadlock","source":"eclipse"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-02T16:19:35.690129Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation","titleSource":"eclipse","descriptionSource":"eclipse","description":"In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.","score":6.8,"severity":"medium","published":"2026-11-02T14:57:27.483Z","modified":"2026-11-02T16:19:56.290Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Eclipse Foundation","name":"Eclipse ThreadX","platforms":[],"versions":[{"version":"6.0.1","status":"affected","lessThanOrEqual":"6.5.2.202603","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"eclipse","url":"https://www.cve.org/CVERecord?id=CVE-2026-118052"}],"remediation":[],"references":["https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-67ww-q8x2-g487","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/511"],"sources":[{"name":"CVE","id":"CVE-2026-118052","modified":"2026-11-02T16:19:56.290Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118052"}],"assessments":[{"source":"eclipse","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.8}],"sourceAffected":[],"observedAt":"2026-11-02T16:30:48.248Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-02T15:10:36.301Z","attemptedAt":"2026-11-02T15:10:36.301Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-02T15:10:36.303Z","attemptedAt":"2026-11-02T15:10:36.303Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-02T15:10:36.392Z","attemptedAt":"2026-11-02T15:10:36.392Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-02T15:10:35.403Z","attemptedAt":"2026-11-02T15:10:35.403Z"}],"evidence":[],"aiSummary":{"text":"Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 have a weakness where the Module Manager loaders do not release the mutex when a module preamble's sizes overflow, blocking later module operations. The impact is that loading such an image blocks every later module load, start, stop, and unload from other threads. Local access is required to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-02T15:06:07.104Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118052"}]}}