Eclipse ThreadX 6.5.2.202603b is now available (security hotfix)

[fdesbiens]

Hi everyone.

ThreadX and NetX Duo 6.5.2.202603b are now available. It is a security hotfix: it fixes twenty-one vulnerabilities, eight in ThreadX and thirteen in NetX Duo, and contains no other changes beyond the behaviour changes those fixes require, listed below. FileX, GUIX, LevelX and USBX are unchanged.

ThreadX: update if you use ThreadX Modules on any port, or a TrustZone-M port with its secure stack services. All eight need code already running on the device, in a loaded module or in the non-secure world.

• CVE-2026-115231 (8.5 High) — a user-mode module could post forged requests to another module's callback queue and run its code with that module's privilege.
• CVE-2026-102710 (8.5 High) — a user-mode module could register the kernel's trace-buffer-full callback and run its code with kernel privilege.
• CVE-2026-102709 (8.4 High) — the TrustZone-M secure stack services dereferenced unchecked pointers from the non-secure world.
• CVE-2026-113421 (7.3 High) — a module's trace-buffer-full callback stayed registered after the module was unloaded.
• CVE-2026-115653 (7.0 High) — on the Cortex-M module ports, PendSV saved a user-mode thread's registers through its unchecked stack pointer in privileged mode.
• CVE-2026-102711 (6.9 Medium) — the module loaders trusted the sizes and entry points in a module's preamble.
• CVE-2026-115654 (6.9 Medium) — a memory-protected module could suspend, terminate or re-prioritise threads it does not own.
• CVE-2026-118052 (6.8 Medium) — an overflowing preamble size left the Module Manager mutex held, blocking every later module operation.

What changes for ThreadX applications: user-mode modules can no longer register the trace-buffer-full callback; memory-protected modules can no longer use other modules' callback request queues or control threads they do not own; and three new loaders take the module image's length (txm_module_manager_in_place_load_ext, txm_module_manager_memory_load_ext and txm_module_manager_absolute_load_ext). The four loaders without a length are deprecated but remain available.

NetX Duo: update if you use NetX Secure TLS or DTLS, IPv6 path MTU discovery, BSD raw IPv6 sockets, SRP, PPP, or the DHCP client, FTP client, FTP server or TFTP add-ons. None needs credentials; eight are reachable over the network and five from the local link or segment.

• CVE-2026-114408 (8.7 High) — an ICMPv6 Packet Too Big message made the IP thread dereference a NULL pointer when the destination table was full.
• CVE-2026-115215 (8.7 High) — the DTLS server allocated a session before the cookie exchange, so spoofed datagrams could exhaust the session pool.
• CVE-2026-115403 (8.2 High) — a BSD raw IPv6 send dereferenced a NULL pointer when the destination table was full.
• CVE-2026-102723 (7.1 High) — MSRP dereferenced a NULL pointer when its attribute table was full.
• CVE-2026-102724 (7.1 High) — MRP dereferenced a NULL pointer when evicting the last attribute in a list.
• CVE-2026-102725 (7.1 High) — the MSRP parser read past the packet on an unvalidated attribute list length.
• CVE-2026-102726 (7.1 High) — PPP IPCP option parsing could stall the PPP thread and read past the message.
• CVE-2026-102722 (6.9 Medium) — the FTP client connected its passive data socket to whatever address the server named.
• CVE-2026-102721 (6.9 Medium) — the TFTP client and server read past a short ERROR packet.
• CVE-2026-102719 (6.3 Medium) — the DTLS server issued predictable HelloVerifyRequest cookies.
• CVE-2026-102728 (6.3 Medium) — the TLS and DTLS clients read past short ServerHello and HelloVerifyRequest messages.
• CVE-2026-102727 (6.0 Medium) — the FTP server accepted passive data connections from hosts other than the client.
• CVE-2026-102720 (5.3 Medium) — the DHCP client's option walk read past the received message.

What changes for NetX Duo applications: the DTLS server now uses stateless HMAC cookies, with a new nx_secure_dtls_server_cookie_secret_set service to supply the secret, and NX_SECURE_DTLS_COOKIE_LENGTH must be between 17 and 255; the FTP server refuses passive data connections from any host other than the client, which ends server-to-server (FXP) transfers.

Thirteen of these CVE records were published on 29 September, before the fixes were available, and some still carry placeholder text. They will be corrected to match the advisories.

Each advisory carries the full analysis, the affected configurations and any workaround:
https://github.com/eclipse-threadx/threadx/security/advisories
https://github.com/eclipse-threadx/netxduo/security/advisories

The releases and their notes:
https://github.com/eclipse-threadx/threadx/releases/tag/v6.5.2.202603b_rel
https://github.com/eclipse-threadx/netxduo/releases/tag/v6.5.2.202603b_rel

Six of these were found during internal review. Our thanks to Jo Van Bulck, Tijs Bellefroid, Marton Bognar and Antonis Louka of DistriNet, KU Leuven; SounLabs (@SounLabs); Team Atlanta, OSTIF and Shielder (@suidpit, @acorn421); @max-r-b and @enitmar of SecMate and @wsparks-vc of VulnCheck; @adawn0106; @L0stHeart; @testacegi and @alex16848; @tinic; and zhangph (@afldl), who reported the others responsibly and waited while the fixes were prepared.

Frédéric Desbiens
Project Lead, Eclipse ThreadX