Module object allocation size overflow corrupts the manager object pool

GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

Cortex-A7 module data validation checks only the first address of a caller-supplied range

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Modul…

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

Module object deallocation can free a live ThreadX kernel object

Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion