[threadx] ThreadX v6.4.5 is now available

[Frédéric Desbiens <frederic.desbiens@xxxxxxxxxxxxxxxxxxxxxx>]

Hi everyone.

It is my pleasure to announce the availability of Eclipse ThreadX version 6.4.5.202504. This service release bundles minor fixes and improvements. It also addresses a handful of security vulnerabilities in ThreadX, NetX Duo, and USBX.

Starting with this version, the version numbers will stay aligned across all the core components (ThreadX / ThreadX SMP, NextX Duo, USBX, FileX, GUIX, LevelX). In the past, new versions of ThreadX and its companion components were published only when there were changes to the codebase. This led to discrepancies in version numbers. The Eclipse Foundation security team recommended that we move away from this approach, as it makes it harder to track things from a cybersecurity standpoint.

In the future, we will keep version numbers aligned by publishing a new version of every component every quarter — whether there have been changes to the codebase or not. The release notes will clearly state if a specific release is simply a version number update.

ThreadX
This release fixes a typo in the name of one of the common constants. It also addresses a security vulnerability in the POSIX compatibility layer.

Vulnerability addressed:

• CVE-2026-0648 Persistent Initialisation Pointer Corruption in the POSIX Compatibility Layer

Full release notes: 
https://github.com/eclipse-threadx/threadx/releases/tag/v6.4.5.202504_rel

NetX Duo
This release addresses a denial-of-service vulnerability in the IPv6 stack.

Vulnerability addressed:

• CVE-2025-55102 Eclipse ThreadX NetX Duo IPv6 denial of service

Full release notes:
https://github.com/eclipse-threadx/netxduo/releases/tag/v6.4.5.202504_rel


USBX

This release delivers specific HID improvements and solves a compilation issue when the library is used in standalone mode.

Vulnerability addressed:

• CVE-2025-55095 Unbound recursion in _ux_host_class_storage_media_mount() via extended partition chains

Immediately after this release was made available, we published the USBX 6.4.5.202504a hotfix release to address issues preventing our regression test suite from running. There are no other fixes or improvements in that hotfix release.

Full release notes:
https://github.com/eclipse-threadx/usbx/releases/tag/v6.4.5.202504_rel
https://github.com/eclipse-threadx/usbx/releases/tag/v6.4.5.202504a_rel


FileX 

This version fixes an issue in media driver status initialisation.

Full release notes:
https://github.com/eclipse-threadx/filex/releases/tag/v6.4.5.202504_rel


LevelX
This release introduces a new API for NOR flash storage. It also addresses several bugs, one of which could lead to memory corruption.

Full release notes:
https://github.com/eclipse-threadx/levelx/releases/tag/v6.4.5.202504_rel

GUIX
This release is a simple version update. It is similar to v.6.4.3.202503. There are no code changes in the GUIX library or GUIX studio.

-----

While the v6.4.5 release was a little thin, the next one will likely bundle major new features and improvements. Stay tuned! If you are curious about whatwe are working on, please feel free to take a look at our public roadmap on GitHub.

Happy coding!

Best Regards,

Frédéric DESBIENS

Project Lead | Eclipse ThreadX  

Senior Manager — Embedded and IoT | Eclipse Foundation

Mastodon: @fdesbiens@xxxxxxxxxxxxxxxxxxxxx

Eclipse Foundation: The Community for Open Innovation and Collaboration