Eclipse Threadx Usbx
Monthly
Out-of-bounds heap read in the Eclipse ThreadX USBX host stack can be triggered when a malicious USB device presenting the MTP/PTP class is attached and the host performs ordinary object enumeration, causing adjacent heap memory to be disclosed to the application or an unmapped-page fault that crashes the host. The issue is physically gated: an unauthenticated attacker needs physical access, and the target must be running USBX in USB host mode with MTP/PTP support enabled and must enumerate the crafted device. Vendor scoring is CVSS 4.0 5.2 (Medium); no public exploit was identified at time of analysis, and impact is limited to low confidentiality loss plus possible denial of service, with no integrity impact or code execution.
An out-of-bounds read exists in the Eclipse ThreadX USBX host stack's USB Video Class handling: when a malicious USB device declares a VideoStreaming interface wTotalLength larger than the format, frame, and frame-interval descriptors it actually transmits, the host trusts that self-reported size as its parsing budget and walks past the end of the configuration buffer. The bug is only triggered when the application queries format or frame data, not during enumeration, and requires physically attaching a crafted USB device to a host built with USBX video-class host support. No public exploit code or active exploitation was identified at time of analysis, and the physical attack vector keeps practical risk low-to-moderate despite potential information disclosure and host-context denial of service.
Heap out-of-bounds read in the Eclipse ThreadX USBX USB host HID class driver is triggered during ordinary device enumeration when a physically attached HID peripheral returns a short or truncated report descriptor whose item headers declare more payload bytes than were actually transferred. The flaw affects USBX builds configured as a USB host with HID support, requires physical access and a user action to connect the device, and needs no authentication (CVSS 3.1: 4.9, AV:P/AC:L/PR:N/UI:R), with the main impact being a crash or denial of service plus limited information disclosure. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Out-of-bounds heap read in the Eclipse ThreadX USBX host stack can be triggered when a malicious USB device presenting the MTP/PTP class is attached and the host performs ordinary object enumeration, causing adjacent heap memory to be disclosed to the application or an unmapped-page fault that crashes the host. The issue is physically gated: an unauthenticated attacker needs physical access, and the target must be running USBX in USB host mode with MTP/PTP support enabled and must enumerate the crafted device. Vendor scoring is CVSS 4.0 5.2 (Medium); no public exploit was identified at time of analysis, and impact is limited to low confidentiality loss plus possible denial of service, with no integrity impact or code execution.
An out-of-bounds read exists in the Eclipse ThreadX USBX host stack's USB Video Class handling: when a malicious USB device declares a VideoStreaming interface wTotalLength larger than the format, frame, and frame-interval descriptors it actually transmits, the host trusts that self-reported size as its parsing budget and walks past the end of the configuration buffer. The bug is only triggered when the application queries format or frame data, not during enumeration, and requires physically attaching a crafted USB device to a host built with USBX video-class host support. No public exploit code or active exploitation was identified at time of analysis, and the physical attack vector keeps practical risk low-to-moderate despite potential information disclosure and host-context denial of service.
Heap out-of-bounds read in the Eclipse ThreadX USBX USB host HID class driver is triggered during ordinary device enumeration when a physically attached HID peripheral returns a short or truncated report descriptor whose item headers declare more payload bytes than were actually transferred. The flaw affects USBX builds configured as a USB host with HID support, requires physical access and a user action to connect the device, and needs no authentication (CVSS 3.1: 4.9, AV:P/AC:L/PR:N/UI:R), with the main impact being a crash or denial of service plus limited information disclosure. No public exploit code or confirmed active exploitation was identified at the time of analysis.