{"id":"CVE-2026-102757","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-102757","generatedAt":"2026-10-28T00:54:06.660Z","title":"The reported chain uses that to reach a privileged `memset` across an attacker-chosen range.","description":"An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary.\n\n\n\nThe Module Manager decided whether a privileged service could dereference an object address a module named by asking only whether that address fell outside the module. The manager's object pool is outside every module, so the test was satisfied by an address shifted into the interior of one of the module's own privileged allocations, which denotes no object at all. The bytes such an address presents as a control block are bytes the module put there through ordinary create and set services, so the control block ID at the front of them could be made to read as any type the module chose, and the `_txe_` layer's ID test then agreed. The reported chain uses that to reach a privileged `memset` across an attacker-chosen range.","published":"2026-09-29T18:17:13.000Z","lastModified":"2026-10-02T13:17:21.000Z","status":"Awaiting Analysis","sourceIdentifier":"emo@eclipse.org","cvss":{"version":"4.0","score":8.5,"severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-125","CWE-787","CWE-822","CWE-823","CWE-843"],"affected":[],"epss":{"score":0.00104,"percentile":0.01017,"date":"2026-10-26","history":[{"date":"2026-09-30","score":0.00104,"percentile":0.00955}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-29T18:17:13.000Z","detail":{"score":"8.5","severity":"HIGH","publishedAt":"2026-09-29T18:17:12.907Z"},"summary":"New CVE, high severity (CVSS 8.5)."}],"references":[{"url":"https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-rrjj-jwcw-hvf8","source":"emo@eclipse.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-102757","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}