CVE-2026-96582
Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only **after** it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.
| CWE | CWE-125 CWE-1285 |
| Vendor | eclipse foundation |
| Product | eclipse threadx - usbx |
| Published | Oct 20, 2026 |
| Last Updated | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse threadx - usbx
Be the first to know when new medium vulnerabilities affecting eclipse foundation eclipse threadx - usbx are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
Eclipse Foundation / Eclipse ThreadX - USBX
0 ≤ 6.5.1.202602
References
Credits
🔍 cipher-creator 🔍 acorn421 🔍 adawn0106