CVE-2025-55096
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _ux_host_class_hid_report_descriptor_get() when parsing a descriptor of a USB HID device.
Risk Assessment
This could lead to information disclosure or system crash if exploited by an attacker with access to a USB device.
Recommendation
Update USBX to version 6.4.3 or later. Avoid connecting untrusted USB devices to systems with the vulnerable version.
Other vulnerabilities in USBX
See all- CVE-2025-55100Critical
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.
- CVE-2025-55099Medium
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.
- CVE-2025-55098Medium
In USBX (USB support module for Eclipse Foundation ThreadX) before version 6.4.3, a potential out-of-bounds read exists in _ux_host_class_audio_device_type_get() when parsing a USB audio device descriptor.
- CVE-2025-55097Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.
Original NVD description (English source)
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_hid_report_descriptor_get() when parsing a descriptor of an USB HID device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS