Eclipse ThreadX up to 6.4.2 _ux_host_class_storage_media_mount stack-based overflow

Summaryinfo

A vulnerability described as critical has been identified in Eclipse ThreadX up to 6.4.2. Affected is the function _ux_host_class_storage_media_mount. Executing a manipulation can lead to stack-based overflow. This vulnerability is tracked as CVE-2025-55095. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability has been found in Eclipse ThreadX up to 6.4.2 and classified as critical. This vulnerability affects the function _ux_host_class_storage_media_mount. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition. This recursion occurs in _ux_host_class_storage_partition_read(), which parses up to four partition entries. If an extended partition is found (with type UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED or EXTENDED_LBA_MAPPED), the code invokes: _ux_host_class_storage_media_mount(storage, sector + _ux_utility_long_get(...)); There is no limit on the recursion depth or tracking of visited sectors. As a result, a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-55095 since 08/06/2025. The exploitation appears to be difficult. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.4.0
• 6.4.1
• 6.4.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion