CVE-2026-96402
MediumCVSS 5.2Summary
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
Risk Assessment
Connecting a malicious USB device may lead to memory data leakage or a system crash, posing a risk to confidentiality and availability.
Recommendation
Restrict connection of untrusted USB MTP/PTP devices and apply the USBX fix as soon as it becomes available.
Other vulnerabilities in USBX
See all- CVE-2026-96582Medium
The USBX host stack has a vulnerability where HID report descriptor parsing checks item size only after advancing past the header and parsing the payload, and does not compare declared sizes against actual received bytes. A HID peripheral returning a short report descriptor causes a heap out-of-bounds read during ordinary enumeration.
- CVE-2026-96406Medium
The USBX host stack has a vulnerability in the VideoStreaming interface where the wTotalLength field is used as a budget for walking descriptors without validating against the actual received configuration descriptor size. A device reporting a larger wTotalLength than supplied descriptors causes an out-of-bounds read of the configuration buffer.
- CVE-2025-55100Critical
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.
- CVE-2025-55099Medium
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.
- CVE-2025-55098Medium
In USBX (USB support module for Eclipse Foundation ThreadX) before version 6.4.3, a potential out-of-bounds read exists in _ux_host_class_audio_device_type_get() when parsing a USB audio device descriptor.
- CVE-2025-55097Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.
- CVE-2025-55096Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _ux_host_class_hid_report_descriptor_get() when parsing a descriptor of a USB HID device.
Original NVD description (English source)
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS