Read the docs
TI-2026-76840 Aliases CVE-2026-96406

USBX VIDEO descriptor walk trusts device-supplied wTotalLength as its bound

Priority LOW 22CWE-125Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Eclipse ThreadX USBX, from 0 through 6.5.1.202602, trusts the wTotalLength value a VideoStreaming interface reports in its class-specific descriptor block and uses it as the bound when walking format, frame and frame-interval descriptors, without checking it against the configuration descriptor received. This missing bounds check causes an out-of-bounds read (CWE-125): a device reporting a wTotalLength larger than its data makes the walk read past the end of the configuration buffer in the host's context when the application queries format or frame data. Exploitation requires a physically present user to connect a crafted USB device. CISA KEV does not list the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received. A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0017 6th percentileScored 2026-11-07
Fix Fixed Eclipse ThreadX - USBX (Eclipse Foundation): 6.5.2.202603

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse ThreadX - USBXup to 6.5.1.2026026.5.2.202603Patch availableCNA
  • Eclipse ThreadX - USBX VendorEclipse Foundation Affected up to 6.5.1.202602 Fixed in 6.5.2.202603 Patch available CNA

Remediation

Update Eclipse ThreadX USBX to version 6.5.2.202603 or later, which fixes this flaw. The sources list no advisory for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Eclipse ThreadX - USBX (Eclipse Foundation) Fixed in 6.5.2.202603

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-96406

References

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences