Eclipse USBX CVE-2025-55097

Requires physical access to connect a malicious or malformed USB streaming (audio class) device to a host running USBX before 6.4.3; the flaw is only reachable when the USBX host stack with the audio class driver is present and actively enumerates/parses the attacker-supplied streaming sampling descriptor. Exploitation is fundamentally limited by the physical attack vector (AV:P) - it cannot be performed remotely or over a network - and by the need for the target to parse the crafted descriptor during device enumeration. Impact is confined to availability (a crash/fault); no authentication is required (PR:N) but hands-on hardware access is mandatory.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:P/AC:L/PR:N/UI:N) scores just 2.4 and makes the decisive constraint clear: exploitation requires PHYSICAL access (AV:P) - an attacker must physically connect a malicious USB streaming device to the target. Impact is limited to low availability (VA:L) with no confidentiality or integrity impact (VC:N/VI:N), meaning the realistic outcome is a crash/read fault rather than data theft or code execution. EPSS reinforces this: 0.27% (18th percentile) indicates very low expected exploitation activity, which aligns with the physical-access requirement that inherently prevents mass or remote exploitation. There is no CISA KEV listing and no public exploit code referenced. Note one internal tension worth flagging: the CWE-125 (out-of-bounds read) classification and the 'Information Disclosure' tag suggest a theoretical read-of-adjacent-memory, yet the vendor's own vector assesses confidentiality as N and only availability as L - i.e., the vendor treats the practical consequence as a crash, not a leak. Treat confidentiality impact as unconfirmed/unlikely per the vendor vector. Overall: a real but very low-severity defect that does not warrant emergency prioritization; patch it in normal maintenance cycles, especially for devices exposed to untrusted USB peripherals.

An attacker with brief physical access to a device running vulnerable USBX host firmware connects a crafted USB audio/streaming peripheral with a malformed configuration descriptor. When the host enumerates the device and _ux_host_class_audio_streaming_sampling_get() parses the sampling descriptor, the out-of-bounds read is triggered, likely producing a fault or crash (availability impact). No public exploit code is referenced, and the physical-access and low-complexity profile confine this to someone who can physically attach hardware.