CVE-2026-96582
MediumCVSS 4.9Summary
The USBX host stack has a vulnerability where HID report descriptor parsing checks item size only after advancing past the header and parsing the payload, and does not compare declared sizes against actual received bytes. A HID peripheral returning a short report descriptor causes a heap out-of-bounds read during ordinary enumeration.
Risk Assessment
An attacker could connect a malicious USB device to exploit the vulnerability for memory read or potentially code execution in the host context.
Recommendation
Update the USBX stack to a version containing the fix.
Other vulnerabilities in USBX
See all- CVE-2026-96402Medium
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
- CVE-2026-96406Medium
The USBX host stack has a vulnerability in the VideoStreaming interface where the wTotalLength field is used as a budget for walking descriptors without validating against the actual received configuration descriptor size. A device reporting a larger wTotalLength than supplied descriptors causes an out-of-bounds read of the configuration buffer.
- CVE-2025-55100Critical
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio10_sam_parse_func() when parsing a list of sampling frequencies.
- CVE-2025-55099Medium
In USBX before version 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out-of-bounds read issue in _ux_host_class_audio_alternate_setting_locate() when parsing a descriptor with attacker-controlled frequency fields.
- CVE-2025-55098Medium
In USBX (USB support module for Eclipse Foundation ThreadX) before version 6.4.3, a potential out-of-bounds read exists in _ux_host_class_audio_device_type_get() when parsing a USB audio device descriptor.
- CVE-2025-55097Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _ux_host_class_audio_streaming_sampling_get() when parsing a descriptor of an USB streaming device.
- CVE-2025-55096Medium
In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there is a potential out-of-bounds read issue in _ux_host_class_hid_report_descriptor_get() when parsing a descriptor of a USB HID device.
Original NVD description (English source)
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only **after** it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS