A memory corruption vulnerability in Eclipse ThreadX (CVE-2026-0648) can lead to system crashes or unauthorized memory access when the counter pool is exhausted.

The vulnerability involves incorrect error-checking logic within the CreateCounter function, where a failure return value is misinterpreted. This causes the system to process an error code as a valid pointer, resulting in a write to an illegal memory address when the counter pool is empty.

Successful exploitation of this flaw can result in a denial-of-service condition through repeated exhaustion of the counter pool or silent memory corruption. Given the CVSS score of 7.8, this vulnerability represents a high risk to system stability and integrity, particularly in embedded environments where ThreadX is deployed.

Immediate Action: Update Eclipse ThreadX to the version containing the fix for commit 4b6e8100d932a3a67b34c6eb17f84f3bffb9e2ae as referenced in the official GitHub advisory.

Proactive Monitoring: Monitor system logs for unexpected HardFaults or recurring service restarts that may indicate memory corruption or resource exhaustion attempts.

Compensating Controls: Implement strict input validation or rate limiting on system calls that invoke the CreateCounter function to prevent rapid depletion of the counter pool.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Eclipse ThreadX versions 6.1.7 through 6.4.3 must prioritize the application of the vendor-provided patch. Due to the potential for memory corruption and system-wide instability, this update should be integrated into the standard maintenance cycle with high urgency to ensure operational continuity.