All vulnerabilities
CVE-2026-96402GHSA-2ch9-p8xv-fwp6

USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

Eclipse Foundation Eclipse ThreadX - USBX
Open in ThreatlineRecord JSON
CVSS
5.2Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.5.2.202603Fixed versionGitHub
Published20 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 6.5.2.202603USBX, eclipse threadxGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.

Text from CVE List

Affected versions 3

  • Eclipse ThreadX - USBXaffected: all versions through 6.5.1.202602CVE List
  • Eclipse ThreadX - USBXunaffected: 6.5.2.202603CVE List
  • USBX, eclipse threadx<= 6.5.1.202602GitHub

References 1