CVE-2026-96582 in ThreadX
Summary
by MITRE • 10/20/2026
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it.
The walk checked that an item fitted in the descriptor only **after** it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability resides within the USBX host stack implementation regarding the parsing of Human Interface Device (HID) report descriptors. These descriptors are critical data structures that define how a host communicates with HID peripherals, such as keyboards or mice, by specifying input and output reports through a sequence of items. Each item in this descriptor begins with a header byte indicating its type and length, followed by the specified number of payload bytes. The core technical flaw is an incorrect order of operations during the parsing process. Specifically, the implementation advances past the header and attempts to parse or validate the payload before verifying whether the declared size fits within the bounds of the received descriptor data. This logic error means that if a peripheral provides a malformed report descriptor where the length field exceeds the actual remaining bytes in the buffer, the parser will proceed to read memory beyond the allocated heap space associated with the descriptor structure.
This out-of-bounds read occurs during the device enumeration phase, which is typically one of the first interactions between a host and a newly connected USB device. Because this process happens automatically upon connection without requiring user interaction or elevated privileges, it presents a significant attack surface for remote exploitation scenarios where an attacker can physically connect a malicious HID device to a target system. The immediate operational impact is a heap-based buffer over-read, which allows the reading of arbitrary memory contents adjacent to the descriptor buffer. While this specific flaw does not directly lead to code execution or privilege escalation on its own, it compromises data confidentiality by potentially leaking sensitive information stored in nearby memory locations. Furthermore, such out-of-bounds reads can destabilize the application state, leading to crashes or denial of service conditions if the read values are subsequently used in logical operations that expect valid pointers or integers.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. It also relates to CWE-20, Improper Input Validation, as the system fails to correctly validate that the length field in the HID report descriptor matches the actual available data size before processing it. In terms of attack vectors and techniques, this flaw facilitates attacks categorized under MITRE ATT&CK technique T1563, Remote Service Vulnerability Exploitation, specifically within the context of physical access or device insertion attacks like BadUSB. The lack of strict boundary checks during enumeration allows an attacker to leverage standard USB HID protocols as a vector for information disclosure or system instability.
Mitigation strategies must focus on enforcing strict validation rules before any data processing occurs. Developers should modify the parsing logic in the USBX host stack to verify that the total size of the report descriptor, calculated by summing header sizes and their respective payload lengths, does not exceed the actual buffer length received from the peripheral. This check must be performed prior to advancing pointers or accessing memory for any item within the descriptor sequence. Additionally, implementing bounds checking on every individual item access ensures that even if a single item is malformed, it will not trigger an out-of-bounds read. Security testing should include fuzzing HID report descriptors with intentionally truncated or oversized length fields to ensure robustness against such malformed inputs. Updating affected firmware and software stacks to patch this enumeration logic error is essential for maintaining the integrity of USB device interactions.