CVE-2026-96406
MediumCVSS 4.9Summary
The USBX host stack has a vulnerability in the VideoStreaming interface where the wTotalLength field is used as a budget for walking descriptors without validating against the actual received configuration descriptor size. A device reporting a larger wTotalLength than supplied descriptors causes an out-of-bounds read of the configuration buffer.
Risk Assessment
An attacker could connect a malicious USB device to exploit the vulnerability for memory read or potentially code execution in the host context.
Recommendation
Update the USBX stack to a version containing the fix.
Other vulnerabilities in USBX
See all- CVE-2026-96402Medium
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
- CVE-2026-96582Medium
The USBX host stack has a vulnerability where HID report descriptor parsing checks item size only after advancing past the header and parsing the payload, and does not compare declared sizes against actual received bytes. A HID peripheral returning a short report descriptor causes a heap out-of-bounds read during ordinary enumeration.
- CVE-2025-55100Critical
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.
- CVE-2025-55099Medium
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.
- CVE-2025-55098Medium
In USBX (USB support module for Eclipse Foundation ThreadX) before version 6.4.3, a potential out-of-bounds read exists in _ux_host_class_audio_device_type_get() when parsing a USB audio device descriptor.
- CVE-2025-55097Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.
- CVE-2025-55096Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _ux_host_class_hid_report_descriptor_get() when parsing a descriptor of a USB HID device.
Original NVD description (English source)
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received. A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS