CVE-2026-96406: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX - USBX

This vulnerability involves an out-of-bounds read (CWE-125) in the USBX component of Eclipse ThreadX. Specifically, the VideoStreaming interface reports the size of its class-specific descriptor block in the wTotalLength field, which the USBX host uses as a budget for parsing descriptors. However, the host does not verify this size against the actual configuration descriptor length received. If a device reports a wTotalLength larger than the actual descriptors, the host continues reading past the end of the buffer, causing out-of-bounds memory access in the host's context when applications query format or frame data.

The vulnerability can cause the host system to read memory beyond the intended buffer, potentially leading to application crashes or denial of service (availability impact). The CVSS vector indicates low confidentiality and integrity impact but high availability impact. There is no indication of code execution or data disclosure from the provided data.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when connecting untrusted USB devices that use the VideoStreaming interface in affected versions.