CVE-2026-102711

MediumCVSS 5.7/10Last modified Sep 29, 2026

Description

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_in_place_load` — APIs that take ONLY a base pointer, no image length, so every size/offset field in `TXM_MODULE_PREAMBLE` is fully attacker-trusted: (1) a heap OOB **read** (`code_size` trusted as the source-image length in the code-copy loop), and (2) a control-flow-integrity / defense-in-depth gap (module entry/start/callback/stop pointers computed as `code_start + preamble_offset` with only a `!= 0` check, and the preamble `checksum` never verified). No controlled OOB write was found (honest — the copy destination is overflow-guarded).

Metrics

CVSS 4.0 5.7/10

CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-125 CWE-345 CWE-1284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1027128.8On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the CVE-2026-1027138.8The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tftp_server.c:1037) an CVE-2026-1027147.1`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.c:79`). An area whos CVE-2026-1027157.1Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table store CVE-2026-1027168.7An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser CVE-2026-1027177.5MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash CVE-2026-1027188.7hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer CVE-2026-1027196.3Predictable DTLS HelloVerifyRequest Cookie in NetX Secure CVE-2026-102726.5A vulnerability has been found in a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0. The impacted element is an CVE-2026-1027205.3A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the end of the received CVE-2026-1027216.9A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive pat CVE-2026-1027226.9In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and th