CVE-2025-55099
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.
Risk Assessment
The vulnerability may lead to improper memory reads, potentially resulting in information disclosure or system crash, especially in embedded environments.
Recommendation
It is recommended to update USBX to version 6.4.3 or later, which includes a fix for this issue.
Other vulnerabilities in USBX
See all- CVE-2025-55100Critical
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.
- CVE-2025-55098Medium
In USBX (USB support module for Eclipse Foundation ThreadX) before version 6.4.3, a potential out-of-bounds read exists in _ux_host_class_audio_device_type_get() when parsing a USB audio device descriptor.
- CVE-2025-55097Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.
- CVE-2025-55096Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _ux_host_class_hid_report_descriptor_get() when parsing a descriptor of a USB HID device.
Original NVD description (English source)
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS