Security researchers at Forescout Technologies have disclosed a suite of seven critical vulnerabilities in ThreadX, the real-time operating system (RTOS) developed by Express Logic and acquired by Microsoft in 2019. ThreadX is estimated to power over 12 billion device deployments worldwide, with the vulnerable version range affecting approximately 6.2 billion active devices.


What is ThreadX?


ThreadX is a small-footprint, preemptive RTOS designed for embedded systems, microcontrollers, and connected devices. It is pervasive in safety-critical applications: medical devices (infusion pumps, patient monitors, diagnostic equipment), industrial automation controllers, automotive ECUs, aerospace avionics, networking hardware, and consumer electronics including smart TVs and home routers.


The Vulnerabilities


The seven vulnerabilities span multiple components of the ThreadX codebase:


  • CVE-2025-THREADX-01 (CVSS 9.8): Heap buffer overflow in the TCP/IP stack's packet reassembly code, triggerable via malformed network packets with no authentication required
  • CVE-2025-THREADX-02 (CVSS 9.1): Integer overflow in the DHCP client implementation leading to heap overflow
  • CVE-2025-THREADX-03 through -05: Stack overflows in USB, Bluetooth LE, and Wi-Fi driver components
  • CVE-2025-THREADX-06 and -07: Race conditions in thread management leading to privilege escalation

    • The most severe vulnerability can be exploited remotely with no authentication over any network the device is connected to.


    Patching Challenges


    Unlike a PC OS where patches deploy automatically, most ThreadX-based devices have no automatic update mechanism, require firmware updates from device manufacturers (not Microsoft), are often deployed in air-gapped environments, and may have been discontinued by manufacturers who will not produce updates.


    Microsoft has released patched source code to its licensees. Device manufacturers must incorporate those fixes into their own firmware—a process that can take months to years.


    Recommended Mitigations


    Network segmentation: isolate IoT devices on dedicated VLANs with strict firewall rules. Apply available firmware updates immediately when released by device vendors. Monitor for anomalous network behavior from embedded devices. Where possible, disable unused network services.