ThreadX USBX CVE-2025-55098

Requires physical access (AV:P) to a USB port of a device running ThreadX/USBX as a USB HOST, which must enumerate an attacker-supplied USB AUDIO class device so that _ux_host_class_audio_device_type_get() parses the crafted (malformed) audio descriptor. Limiting factors: physical presence to insert the device, high attack complexity (AC:H) to craft a descriptor that reliably triggers the out-of-bounds read, affected versions are USBX before 6.4.3 (fixed in 6.4.3), and impact is bounded to low integrity/availability with no confidentiality loss - this is not remotely exploitable.

This is a genuinely low-priority issue despite the presence of public exploit code, and the signals are broadly consistent on that point. The vendor CVSS 4.0 vector (AV:P/AC:H/PR:N/UI:N/VC:N/VI:L/VA:L) yields a base score of only 1.0: exploitation requires PHYSICAL access to the device's USB port, high attack complexity, and the impact is limited to low integrity and low availability with NO confidentiality impact (VC:N). This is important because CWE-125 (out-of-bounds read) is frequently assumed to leak data, but the vendor explicitly rates confidentiality as none - the realistic outcome is a parser fault/crash of the USB host stack (availability) rather than meaningful memory disclosure. EPSS is low at 0.33% (23rd percentile), there is NO CISA KEV listing, and while POC/exploit material is referenced via the GHSA advisory, POC availability is NOT the same as active exploitation. The one tension worth noting: the 'Information Disclosure' tag and the VC:N rating conflict (see data_quality_flags), and a physical-access AV:P flaw is structurally incompatible with any scenario of widespread remote exploitation. Net: not a patch-tonight item; schedule it into normal firmware update cycles for affected embedded products.

An attacker with physical access crafts a malicious USB audio device presenting a malformed audio descriptor and plugs it into a ThreadX/USBX host. When the host enumerates the device and calls _ux_host_class_audio_device_type_get() to parse the descriptor, the function reads past the buffer bounds, corrupting state or crashing the USB host stack. Public exploit/POC material is referenced in the GHSA advisory, but exploitation is bounded by the requirement for physical device insertion and high complexity.