Eclipse ThreadX USBX CVE-2025-55100

Requires physical access to attach a crafted USB device to a target running Eclipse ThreadX USBX (before 6.4.3) configured as a USB HOST with the USB Audio Class 1.0 host driver compiled/enabled, plus the act of connecting/enumerating the device (UI:A). The malicious device must advertise a malformed list of sampling frequencies so that _ux_host_class_audio10_sam_parse_func() reads out of bounds. Exploitation is strongly LIMITED by: the need for physical presence (AV:P), the requirement that the host actually uses the audio10 host class, and an impact ceiling of a bounded memory over-read yielding only low-confidentiality information disclosure (no code execution, integrity, or availability impact).

Signals are consistent and collectively point to a LOW real-world priority. The vendor-supplied CVSS 4.0 vector (AV:P/AC:L/PR:N/UI:A) and base score of 2.4 indicate the attack requires PHYSICAL access to the target device plus active user interaction (physically attaching a malicious USB peripheral), with only a low confidentiality impact (VC:L) and no integrity or availability impact. EPSS is 0.56% (45th percentile), i.e. low predicted exploitation likelihood, which aligns with the physical attack vector - this is not a remotely scalable or automatable issue. The vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. Publicly available exploit code exists (referenced in the Eclipse GHSA advisory), but POC availability is a distinct signal from in-the-wild exploitation and should not be conflated with it. All signals agree: a genuine but low-severity, physically-gated out-of-bounds read (CWE-125) with limited information-disclosure impact. No conflicting data was identified; the main caveat is that impact is a memory over-read, so practical data leakage is bounded by what adjacent memory contains.

An attacker with physical access crafts a malicious USB audio device whose descriptor advertises a malformed list of sampling frequencies, then plugs it into a host device running the USBX host stack. When the host's USB Audio Class 1.0 driver calls _ux_host_class_audio10_sam_parse_func() to parse the frequency list, it reads out of bounds, potentially disclosing small amounts of adjacent memory. Public exploit code is referenced in the Eclipse GHSA advisory, but exploitation requires the attacker to be physically present to attach the device.