TI-2026-76841 Aliases CVE-2026-96582

Out-of-bounds read in Eclipse USBX HID report descriptor parser

LOW 22CWE-125Published 2026-10-20 · Updated 2026-10-20

Key facts

Attack vector: Physical
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Eclipse ThreadX - USBX versions from 0 through 6.5.1.202602 are affected. The HID report descriptor parser checks that an item fits in the descriptor only after it has already advanced past the header and parsed the payload, and it never compares declared sizes with the bytes received (CWE-125). A physically present attacker with no privileges can trigger a heap out-of-bounds read during ordinary enumeration by using a HID peripheral that returns a short report descriptor, with user interaction required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only **after** it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0017 6th percentileScored 2026-11-07

Fix Fixed Eclipse ThreadX - USBX (Eclipse Foundation): 6.5.2.202603

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Eclipse Foundation	Eclipse ThreadX - USBX	up to 6.5.1.202602	6.5.2.202603	Patch available	CNA

Eclipse ThreadX - USBX VendorEclipse Foundation Affected up to 6.5.1.202602 Fixed in 6.5.2.202603 Patch available CNA

Remediation

Upgrade Eclipse ThreadX - USBX to 6.5.2.202603, the fixed version listed for this flaw. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Eclipse ThreadX - USBX (Eclipse Foundation) Fixed in 6.5.2.202603

Timeline

2026-10-20 Threatist record created from CVE-2026-96582

References

Other 1

https://github.com/eclipse-threadx/usbx/security/advisories/GHSA-f2fv-fqrc-h8jr

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3

See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences