[threadx] ThreadX v 6.4.3 is now available

[Frédéric Desbiens <frederic.desbiens@xxxxxxxxxxxxxxxxxxxxxx>]

Hi everyone.

I am pleased to announce the availability of Eclipse ThreadX version 6.4.3. This service release bundles minor fixes and improvements. It also addresses a significant number of security vulnerabilities. 

ThreadX (Eclipse ThreadX v.6.4.3.202503)

The main change in this release is the new configuration parameter TX_QUEUE_MESSAGE_MAX_SIZE in tx_api.h, which defines the maximum message size for queues. The default value is set to TX_ULONG_16 to maintain backwards compatibility.

Vulnerabilities addressed:

• CVE-2025-55078 A kernel object pointer validation flaw in ThreadX system calls allows attackers to supply pointers to reserved memory regions.
• CVE-2025-55079 Module thread can achieve a higher priority than txm_module_instance_maximum_priority
• CVE-2025-55080 Improper Parameter Check in ThreadX Syscall Implementation

Full release notes: 
https://github.com/eclipse-threadx/threadx/releases/tag/v6.4.3.202503_rel

NetX Duo (Eclipse ThreadX NetX Duo 6.4.4.202503)
This release fixes several security vulnerabilities and non-security issues. Also, an implementation of the ECDHE_PSK cipher suites is now available.

Vulnerabilities addressed:

• CVE-2025-55081 Potential out-of-bounds read in _nx_secure_tls_process_clienthello()
• CVE-2025-55082 Out-of-bounds read and possible info leak in _nx_secure_tls_psk_identity_find()
• CVE-2025-55083 Broken bounds check in _nx_secure_tls_process_clienthello_psk_extension() doesn't account for offset
• CVE-2025-55084 Off-by-one out of bound read in _nx_secure_tls_proc_clienthello_supported_versions_extension()
• CVE-2025-55090 Potential out-of-bounds read issue in _nx_ipv4_packet_receive()
• CVE-2025-55091 Potential out-of-bounds read in _nx_ip_packet_receive()
• CVE-2025-55092 Potential out-of-bounds read in _nx_ipv4_option_process()
• CVE-2025-55093 Out-of-bounds read and write in _nx_ipv4_packet_receive() when handling unicast DHCP messages
• CVE-2025-55094 Potential out-of-bounds read in _nx_icmpv6_validate_options()

The v6.4.4.202503 release was made before all fixes had been properly merged. Consequently, we made the v6.4.4.202503a hotfix release shortly after. The hotfix release addresses compilation issues when websockets are used in secure mode.

The following three components will be deprecated in the next minor release and completely removed in a subsequent release: Azure IoT Middleware for Azure RTOS, IPSEC, and NetX Duo HTTP Server. Please refer to the release notes for details.  

Full release notes: 
https://github.com/eclipse-threadx/netxduo/releases/tag/v6.4.4.202503a
https://github.com/eclipse-threadx/netxduo/releases/tag/v.6.4.4.202503_rel

USBX (Eclipse ThreadX USBX v6.4.3.202503)

This release updates the vendor ID of USBX from "AzureRTO" to "Eclipse" It also fixes several issues, including security vulnerabilities.

Vulnerabilities addressed:

• CVE-2025-55096 Inadequate bounds check and potential underflow in _ux_host_class_hid_report_descriptor_get()
• CVE-2025-55097 Potential out-of-bounds read in _ux_host_class_audio_streaming_sampling_get()
• CVE-2025-55098 Potential out-of-bounds read in _ux_host_class_audio_device_type_get()
• CVE-2025-55099 Potential out-of-bounds read in _ux_host_class_audio_alternate_setting_locate()
• CVE-2025-55100 Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

Full release notes: https://github.com/eclipse-threadx/usbx/releases/tag/v6.4.3.202503_rel

FileX (Eclipse ThreadX FileX v6.4.2.202503)
The only change in this release is a correction of the boot record and FSINFO signatures. Also, a buffer overflow has been fixed in the sample code shipping with FileX.

Vulnerability addressed:

• CVE-2025-55089 Eclipse ThreadX FileX RAM disk driver buffer overflow vulnerability (TALOS-2024-2088)

Full release notes:
https://github.com/eclipse-threadx/filex/releases/tag/v6.4.2.202503_rel

GUIX (Eclipse ThreadX GUIX v6.4.3.202503)

It is now possible to turn off ARC_DRAWING support to reduce code size.

Full release notes: 

https://github.com/eclipse-threadx/guix/releases/tag/v6.4.3.202503_rel

=====

You probably noticed something changed in our version numbers. Please take a look at my blog post for an explanation. 

Best Regards,

Frédéric DESBIENS

Project Lead | Eclipse ThreadX  

Senior Manager — Embedded and IoT | Eclipse Foundation

Mastodon: @fdesbiens@xxxxxxxxxxxxxxxxxxxxx

Eclipse Foundation: The Community for Open Innovation and Collaboration