Frédéric Desbiens

NetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check

Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protected module register any function pointer as the kernel's trace-buffer-full callback, which the kernel calls from pr

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread pointer supplied by the non-secure world without checking that it points to non-secure memory. Non-se

NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation

User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own

Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode