https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 10:06:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-95111 <p>A memory-protected ThreadX module&#39;s queue request reaches the Module Manager&#39;s dispatch layer, which decides how much of the module&#39;s buffer the privileged queue copy may touch and hands that extent to the module port&#39;s range check. A queue&#39;s `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes.</p> <p>The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied.</p> <p>A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue&#39;s message area, so a module that can receive from that queue reads them back.</p> <p>A memory-protected ThreadX module&#39;s queue request reaches the Module Manager&#39;s dispatch layer, which decides how much of the module&#39;s buffer the privileged queue copy may touch and hands that extent to the module port&#39;s range check. A queue&#39;s `tx_queue_message_size` is a count of `ULONG`s and the copy moves that many words, so the extent is `message_size * sizeof(ULONG)` bytes.</p> <p>The front-send dispatcher passed the word count itself. `tx_queue_send` and `tx_queue_receive`, either side of it in the same header, have always multiplied.</p> <p>A source buffer ending `message_size` bytes into memory the module may read was therefore accepted, and `_txe_queue_front_send` then read `message_size * sizeof(ULONG)` bytes from it in privileged mode — `3 * message_size` bytes past the end of what the module is allowed to read. The words are written into the queue&#39;s message area, so a module that can receive from that queue reads them back.</p> https://db.gcve.eu/vuln/fkie_cve-2026-95111