CVE-2026-96402

The USBX host class is vulnerable to an out-of-bounds read (CWE-125) within its PIMA/MTP implementation. A malicious USB MTP/PTP device can trigger this vulnerability during ordinary object enumeration by over-reporting its object handle count. This causes the host to read past its heap receive b...

CVE-2026-96402 USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

Exploit for CVE-2026-67340

CVE-2026-67340 — ArcadeDB JAVASCRIPT Trigger-Script RCE post-...

PT-2026-64828

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATE SCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...

CVE-2025-55099

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudioalternatesettinglocate when parsing a descriptor with attacker-controlled frequency fields...

CVE-2025-55098

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudiodevicetypeget when parsing a descriptor of an USB audio device...

CVE-2025-55097

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudiostreamingsamplingget when parsing a descriptor of an USB streaming device...

CVE-2025-55100

CVE-2025-55100 affects USBX (ThreadX USB support module) prior to version 6.4.3. The issue is an out-of-bounds read in the function _ux_host_class_audio10_sam_parse_func() while parsing a list of sampling frequencies, which could lead to a crash or potential data exposure. Red Hat and CVE aggrega...

CVE-2025-55100 Potential out-of-bounds read in _ux_host_class_audio10_sam_parse_func()

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudio10samparsefunc when parsing a list of sampling frequencies...

CVE-2025-55098 Potential out-of-bounds read in _ux_host_class_audio_device_type_get()

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudiodevicetypeget when parsing a descriptor of an USB audio device...

EUVD-2025-34867

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudiostreamingsamplingget when parsing a descriptor of an USB streaming device...

CVE-2025-55097

CVE-2025-55097 affects the USBX USB host module in Eclipse ThreadX prior to version 6.4.3, where an out-of-bounds read can occur in _ux_host_class_audio_streaming_sampling_get() while parsing a USB streaming device descriptor. The issue is described across multiple sources (NVD, Red Hat, CVE reco...

EUVD-2025-34868

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclasshidreportdescriptorget when parsing a descriptor of an USB HID device...

PT-2025-42588

Name of the Vulnerable Software and Affected Versions USBX versions prior to 6.4.3 Description The USB support module for Eclipse Foundation ThreadX contains a potential out-of-bounds read issue within the ux host class audio device type get function when processing a descriptor from a USB audio...

PT-2025-42589

Name of the Vulnerable Software and Affected Versions USBX versions prior to 6.4.3 Description The USB support module for Eclipse Foundation ThreadX contains a potential out-of-bounds read issue within the ux host class audio alternate setting locate function. This occurs when parsing a descripto...

PT-2025-42590

Name of the Vulnerable Software and Affected Versions USBX versions prior to 6.4.3 Description The USB support module for Eclipse Foundation ThreadX contains a potential out-of-bounds read issue within the ux host class audio10 sam parse func function when processing a list of sampling frequencie...

PT-2025-42587

Name of the Vulnerable Software and Affected Versions USBX versions prior to 6.4.3 Description The USB support module for Eclipse Foundation ThreadX contains a potential out-of-bounds read issue within the ux host class audio streaming sampling get function when processing descriptors from a USB...

CVE-2023-48697 Azure RTOS USBX Remote Code Execution Vulnerability

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to memory buffer and pointer vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in...

CVE-2023-48696

Azure RTOS USBX contains a remote code execution vulnerability caused by an expired pointer dereference in the USBX host/CDC ACM path for RTOS v6.2.1 and earlier. Affected component: USBX within Azure RTOS USBX stack (host class/CDC ACM). Remediation: upgrade to USBX release 6.3.0 or later. Explo...

CVE-2023-48695

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack, that is fully integrated with Azure RTOS ThreadX. An attacker can cause remote code execution due to out of bounds write vulnerabilities in Azure RTOS USBX. The affected components include functions/processes in host and...