CVE-2026-96402

EUVD-2026-105024
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
eclipseCNA
5.2 MEDIUM
PHYSICAL
LOW
NONE
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.6%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
eclipsethreadx_usbx
𝑥
≤ 6.5.1.202602
CNA
Common Weakness Enumeration
References
https://github.com/eclipse-threadx/usbx/security/advisories/GHSA-2ch9-p8xv-fwp6