Eclipse ThreadX USBX CVE-2026-96402

Exploitation requires an attacker to physically connect a crafted USB device presenting the MTP (Media Transfer Protocol) / PTP (Picture Transfer Protocol) class to a target running the USBX host stack, and the target must perform ordinary object enumeration of that device - so the host must be operating in USB host mode with MTP/PTP class support enabled. Limiting factors that reduce real-world risk: the attack vector is physical (AV:P), not network-reachable; it requires user/operator interaction to attach and enumerate the device (UI:A); and only devices actually running USBX as a USB host are affected. The realistic worst case is a denial-of-service crash (unmapped-page fault) with a secondary low-impact leak of adjacent heap contents to the application; there is no integrity impact or code execution.

This is a genuine but modest-severity issue best characterized as a physically-gated out-of-bounds read (CWE-125) in the Eclipse ThreadX USBX host stack, with a vendor-assigned CVSS 4.0 score of 5.2 (Medium). The signals are internally consistent rather than conflicting: the CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:A) confirms the dominant limiting factor is physical attack vector plus required user interaction - an attacker must physically attach a malicious USB MTP/PTP device and have it enumerated. Impact is split between low confidentiality (VC:L, adjacent heap leak) and high availability (VA:H, fault on an unmapped page / crash); there is no integrity impact and no code execution, so this is not a remote-code-execution-grade priority. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the intelligence, meaning there is no evidence of active or at-scale exploitation. Overall this reads as a real but low-urgency hardening fix rather than an emergency: the physical-access requirement sharply constrains real-world exploitability, and the primary practical consequence is a denial-of-service crash with a secondary minor information leak. Note the EPSS/KEV/POC data is simply absent (not low) - absence should not be read as a positive 'safe' signal, but nothing here elevates it above routine patching priority for affected embedded fleets.

An attacker with physical access to a device running USBX in host mode plugs in a malicious USB device that advertises the MTP/PTP class with malformed object-enumeration metadata. During ordinary object enumeration the host reads past a heap buffer, either leaking adjacent heap memory contents up to the application or dereferencing an unmapped page and faulting, crashing the device. No public exploit code was identified at the time of analysis.