CVE-2026-96402

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

EUVD-2026-105024

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

CVE-2026-96402

The USBX host class is vulnerable to an out-of-bounds read (CWE-125) within its PIMA/MTP implementation. A malicious USB MTP/PTP device can trigger this vulnerability during ordinary object enumeration by over-reporting its object handle count. This causes the host to read past its heap receive b...

CVE-2026-96402 USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

CVE-2026-96582

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...

CVE-2026-96406

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

EUVD-2026-105002

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

CVE-2026-96406

The USBX host is vulnerable to an out-of-bounds read (CWE-125) during the processing of a VideoStreaming interface . The host incorrectly uses the device-controlled wTotalLength field from the input header as a budget for walking format, frame, and frame-interval descriptors without validating it...

CVE-2026-96582

The USBX HID Report Descriptor Parser is vulnerable to a heap out-of-bounds read during ordinary enumeration. The root cause is a check-after-use flaw where the host validates that an item fits in the descriptor only after advancing past the header and parsing the payload. Because the analysis fa...

CVE-2026-96582 Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...

EUVD-2026-105000

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...

Eclipse ThreadX USBX security vulnerabilities

Eclipse ThreadX USBX is an open-source version of Eclipse ThreadX, which includes a USB host, device, and mobile embedded stack. There is a security vulnerability in Eclipse ThreadX USBX, caused by the uxhostclassstoragemediamount function having unlimited recursive depth, which may lead to a sta...

PT-2025-42590

Name of the Vulnerable Software and Affected Versions USBX versions prior to 6.4.3 Description The USB support module for Eclipse Foundation ThreadX contains a potential out-of-bounds read issue within the ux host class audio10 sam parse func function when processing a list of sampling frequencie...

Eclipse ThreadX USBX buffer error vulnerability

Eclipse ThreadX USBX is an open source USB host, device and mobile embedded stack for Eclipse ThreadX. A buffer error vulnerability exists in Eclipse ThreadX USBX versions prior to 6.4.3, which stems from a potential out-of-bounds read issue when parsing a list of sampling frequencies...

CVE-2025-55100: Out-of-bounds Read

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudio10samparsefunc when parsing a list of sampling frequencies...

CVE-2025-55096: Integer Underflow (Wrap or Wraparound)

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclasshidreportdescriptorget when parsing a descriptor of an USB HID device...

CVE-2025-55097: Out-of-bounds Read

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudiostreamingsamplingget when parsing a descriptor of an USB streaming device...

PT-2025-42589

Name of the Vulnerable Software and Affected Versions USBX versions prior to 6.4.3 Description The USB support module for Eclipse Foundation ThreadX contains a potential out-of-bounds read issue within the ux host class audio alternate setting locate function. This occurs when parsing a descripto...

Eclipse ThreadX USBX buffer error vulnerability

Eclipse ThreadX USBX is an open source USB host, device and mobile embedded stack for Eclipse ThreadX. A buffer error vulnerability exists in Eclipse ThreadX USBX versions prior to 6.4.3 that stems from a potential out-of-bounds read when parsing an attacker-controlled frequency field descriptor...