Which CVEs affect ThreadX 6.4.0?
No note: the vendor names the CVE in its own advisory for this version (11 of 11).
| CVE | Severity | CVSS | Fixed from | Note |
|---|---|---|---|---|
| CVE-2026-102757 | high | 8.5 | not stated | |
| CVE-2025-0726 | high | 7.5 | 6.4.1 | |
| CVE-2025-0727 | high | 7.5 | 6.4.1 | |
| CVE-2025-0728 | high | 7.5 | 6.4.1 | |
| CVE-2025-2258 | high | 7.5 | 6.4.2 | |
| CVE-2025-2259 | high | 7.5 | 6.4.2 | |
| CVE-2025-2260 | high | 7.5 | 6.4.2 | |
| CVE-2025-55080 | high | 7.1 | 6.4.3 | |
| CVE-2026-0648 | medium | 6.3 | 6.4.5 | |
| CVE-2025-55078 | medium | 5.5 | 6.4.3 | |
| CVE-2025-55079 | medium | 5.5 | 6.4.3 |
Which ThreadX version do I need to upgrade to?
Fixed in ThreadX 6.4.1: 3 CVEs of this version.
Fixed in ThreadX 6.4.2: 3 CVEs of this version.
Fixed in ThreadX 6.4.3: 3 CVEs of this version.
Fixed in ThreadX 6.4.5: 1 CVE of this version.
No fix version stated: 1.
What changed against ThreadX 6.3.0?
3 CVEs of 6.3.0 are no longer listed for 6.4.0: CVE-2024-2212, CVE-2024-2214, CVE-2024-2452.
No CVE was added in 6.4.0.
What does the number mean for a device?
Counted are the CVEs public sources name for ThreadX version 6.4.0 (NVD, Vendor advisories). "Confirmed by the vendor" means the CVE record or advisory comes from the vendor itself and names this version as affected. Third-party records are counted but not marked as confirmed.
Whether a CVE is exploitable in a given device depends on which functions of the library the build contains and how they are configured. The list shows what is known for the version.
Questions
How many CVEs does ThreadX 6.4.0 have?
As of 13 Nov 2026, 11 CVEs are known for ThreadX 6.4.0, 0 critical and 8 high. The vendor names 11 in its own advisory for exactly this version. 6.5.1.202602a, the newest listed version, still carries 1 of them.
From which version are the CVEs of ThreadX 6.4.0 fixed?
No newer listed version is free of all 11 CVEs. The "Fixed from" column names the fix version per CVE for this release line where a source states one.
Sources
- [1]NVD