Assume that there is a release coming up from the Eclipse Foundation rather than Microsoft, it's imminent, real soon now. I expect that the appropriate staff are waiting for that to drop, with the 6.3 changes, before they prepare the port.
But to answer your question, if a new bunch of CVEs drop the next day, Microsoft (now Eclipse) prepares the new release, sends out notifications to the appropriate governmental and industry interested parties, then Eclipse ThreadX board members (like ST) determine when to release those changes through their internal processes. It shouldn't matter if there will be more CVEs dropping tomorrow, in Microsoft's case with Windows they decided to push daily and monthly updates, plus bundles. Other companies reach out and force updates. Others, like ATM manufacturers, just run Windows 95 and deal with the exposure. PVR and router manufacturers will just drop support for those models and move on. Others, like medical devices, have rules governing updates of COTS and they may choose to do nothing, they might have to notify the FDA/Health Canada/??? and prepare a plan to overcome the vulnerability, or may ask their customers to take their devices off-line, they may fly out techs to update the systems.
So, then what? It depends, there is not one answer.
