CVE-2026-95111

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's tx queue message size is a count of ULONGs and the copy moves that many words, so the extent is message size * sizeof(ULONG) bytes.

The front-send dispatcher passed the word count itself. tx queue send and tx queue receive, either side of it in the same header, have always multiplied.

A source buffer ending message size bytes into memory the module may read was therefore accepted, and txe queue front send then read message size * sizeof(ULONG) bytes from it in privileged mode — 3 * message size bytes past the end of what the module is allowed to read. The words are written into the queue's message area, so a module that can receive from that queue reads them back.