ThreadX USBX CVE-2025-55099

Requires physical access to connect a malicious USB device to a host running the ThreadX USBX stack with the USB host AUDIO class driver active, so that enumeration invokes _ux_host_class_audio_alternate_setting_locate() to parse the device's audio descriptor. The attacker must supply a descriptor containing crafted/attacker-controlled frequency fields that drive the read past buffer bounds. Limiting factors: physical USB connection is mandatory (AV:P) - no network or remote reach; the target must implement and run the USBX host audio class parsing path; and impact is confined to a low integrity effect (VI:L) with no confidentiality or availability impact scored, so realistic consequence is disrupted/incorrect descriptor processing rather than data theft or persistent compromise.

All signals converge on LOW real-world priority. The vendor CVSS 4.0 base score is 2.4 (Low), driven by AV:P (physical attack vector), meaning exploitation requires physically attaching a malicious USB device to the host running ThreadX USBX - this alone sharply limits scalability and remote mass-exploitation. Impact is minimal: VC:N / VI:L / VA:N (only a low integrity effect; notably no confidentiality impact is scored despite this being a CWE-125 out-of-bounds READ, which is slightly counterintuitive and worth noting - an over-read would typically map to confidentiality or availability, so the vendor appears to judge that the mis-read data influences the alternate-setting-location logic rather than leaking data to the attacker). EPSS is 0.38% (30th percentile), consistent with low expected exploitation. A public exploit/advisory exists (GHSA-93mv-fcpr-9488, flagged as exploit), but the CVE is NOT in CISA KEV, so POC availability must not be conflated with active exploitation. Net: a genuine bug worth patching in affected embedded builds, but not an urgent, widely-weaponizable threat - the physical-access requirement and low impact dominate the high-profile 'buffer overflow / information disclosure' tagging.

An attacker with physical access crafts a malicious USB device that presents an audio-class descriptor with manipulated frequency fields and plugs it into a target device running the ThreadX USBX host stack. During enumeration, the host audio class driver calls _ux_host_class_audio_alternate_setting_locate() and reads past the descriptor buffer, producing an out-of-bounds read. Public exploit/advisory material exists (GHSA-93mv-fcpr-9488), lowering the effort to reproduce, though no active exploitation is confirmed.