---
cve: "CVE-2026-94192"
severity: "HIGH"
cvss: 8.5
epss: "0.2%"
vendor: "Eclipse Foundation"
kev: false
exploited: false
published: "2026-10-20 16:17:18"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-07T10:10:49+01:00"
---

# CVE-2026-94192

> 8.5 HIGH · 🧪 PoC

## Beschreibung

A ThreadX module allocates the control blocks of its kernel objects from the Module Manager's object pool, and can ask for that memory back by address with `txm_module_object_deallocate`. The manager released it whatever was in it, including a control block the kernel was still using. Deallocation is not deletion: the object stays on the created list for its type, a thread stays wherever it was on the ready or suspension lists and stays schedulable, and an active timer stays on the timer list. The byte pool is meanwhile free to hand those same bytes to the next allocation.

## CNA-Record (Kanon, cvelistV5)

- CNA: **eclipse**
- State: PUBLISHED
- Stand: 2026-10-20 17:04:24
- CNA-CVSS: **8.5** (`CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-416** — Use After Free
  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- **CWE-664** — Improper Control of a Resource Through its Lifetime
  The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

## Referenzen

- <https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-57mf-w87f-rq7m>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-94192/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_