Eclipse ThreadX up to 6.5.1.202602 USBX Host wTotalLength buffer overflow

Summaryinfo

A vulnerability has been found in Eclipse ThreadX up to 6.5.1.202602 and classified as problematic. This issue affects some unknown processing of the component USBX Host. The manipulation of the argument wTotalLength leads to buffer overflow. This vulnerability is traded as CVE-2026-96406. An attack has to be approached locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Eclipse ThreadX up to 6.5.1.202602 and classified as problematic. This issue affects an unknown part of the component USBX Host. The manipulation of the argument wTotalLength with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received. A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-96406 since 09/23/2026. The exploitation is known to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion