Eclipse ThreadX USBX CVE-2026-96582

Requires the target to run Eclipse ThreadX USBX configured as a USB HOST with the HID class driver active, and requires physical attachment of an attacker-controlled (or malfunctioning) USB HID peripheral that returns a short/truncated HID report descriptor whose item headers declare more data bytes than were actually transferred; the bug fires automatically during normal device enumeration. Exploitation is limited by physical access (AV:P) and the need for a user or attacker to physically connect the device (UI:R); it is not reachable over any network, requires no authentication (PR:N), and does not apply to devices operating only in USB-device/peripheral mode or without the HID class.

This is a genuinely low-to-moderate, physically-gated issue rather than a remote crisis, and the signals are internally consistent. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, base 4.9 MEDIUM) requires physical attachment of a malicious USB HID peripheral plus a user action to connect it, which fundamentally caps real-world exposure - there is no network-facing path. Impact is a heap out-of-bounds READ (CWE-125), yielding limited information disclosure (C:L) and primarily a denial of service / crash (A:H); there is no integrity impact (I:N) and no code execution claimed. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The only apparent tension is the 'Buffer Overflow' tag versus the actual CWE-125 out-of-bounds READ and the advisory text (a read, not a write/overflow) - treat the issue as an info-leak/DoS, not a memory-corruption RCE. Bottom line: a real but bounded firmware robustness bug whose priority depends entirely on whether the device operates in attacker-reachable USB-host scenarios (kiosks, chargers, field-serviced embedded gear).

An attacker connects (or convinces a user to connect) a malicious or malfunctioning USB HID device that returns a deliberately truncated/short HID report descriptor to a system running Eclipse ThreadX USBX in host mode. During ordinary enumeration, the descriptor walker advances past an item header and parses declared payload bytes that extend beyond the bytes actually received, causing a heap out-of-bounds read that can leak adjacent heap contents or crash the device. No public exploit code is identified at time of analysis, and physical access plus user interaction are required.