CVE-2026-0648 affects eclipse ThreadX, stemming from incorrect error-checking in the CreateCounter() function that causes an error code to be cast as a wild pointer, leading to writes to illegal memory addresses when the counter pool is exhausted. Rated Medium (CVSS 6.3), this vulnerability has a local attack vector and high attack complexity, but can result in denial-of-service via HardFaults and unauthorized memory access with high confidentiality and availability impacts. There is no evidence of active exploitation, public exploit code, or significant community discussion or media coverage at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.1.7, < 6.4.5CPE matchmatch criteria | cpe:2.3:a:eclipse:threadx:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.