CVE-2025-55096: Eclipse ThreadX USBX Buffer Overflow

CVE-2025-55096 Overview

CVE-2025-55096 is an out-of-bounds read vulnerability in Eclipse Foundation ThreadX USBX, the USB support module for the ThreadX real-time operating system. The flaw resides in the _ux_host_class_hid_report_descriptor_get() function, which parses descriptors returned by USB Human Interface Device (HID) peripherals. All versions of USBX before 6.4.3 are affected. The underlying weakness is classified as [CWE-191] Integer Underflow, which allows the parser to read memory outside the intended descriptor buffer when processing a malformed HID report descriptor.

Critical Impact
An attacker with physical access who connects a crafted USB HID device to a vulnerable ThreadX-based embedded system can trigger an out-of-bounds read, potentially leaking small amounts of adjacent memory or destabilizing the USB host stack.

Affected Products

Eclipse Foundation ThreadX USBX versions prior to 6.4.3
Embedded and IoT devices using ThreadX RTOS with the USBX host stack
Firmware implementations that enumerate USB HID peripherals through USBX

Discovery Timeline

2025-10-17 - CVE-2025-55096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55096

Vulnerability Analysis

The vulnerability occurs in _ux_host_class_hid_report_descriptor_get(), the routine responsible for retrieving and parsing the HID report descriptor from an attached USB device. During enumeration, the USB host requests the descriptor and then walks its items to build an internal representation of the device's input, output, and feature reports.

The parser performs length arithmetic on fields supplied by the device without correctly validating that the remaining buffer size can satisfy the computed read. A crafted descriptor can drive this length calculation into an integer underflow, causing the loop to continue past the end of the allocated descriptor buffer. The result is an out-of-bounds read of adjacent heap or stack memory.

Because the parser runs inside the USB host task on the ThreadX RTOS, the consequences depend on the surrounding firmware. Impact ranges from leaking small fragments of memory into subsequent processing logic to triggering a fault that disrupts USB enumeration or crashes the host task.

Root Cause

The root cause is an integer underflow during descriptor length tracking inside _ux_host_class_hid_report_descriptor_get(). The function trusts item-size values embedded in the device-supplied descriptor and subtracts them from a remaining-length counter without first confirming the counter is large enough to absorb the subtraction.

Attack Vector

Exploitation requires local physical access. An attacker connects a malicious USB device, or a programmable device emulating one, that presents a crafted HID report descriptor during enumeration. The ThreadX USBX host then invokes the vulnerable parser, which performs the out-of-bounds read. No user interaction or authentication is required on the target firmware once the device is plugged in.

No verified public exploit code is available. See the Eclipse ThreadX USBX GitHub Security Advisory GHSA-8m9v-jvjp-gmxq for maintainer-provided technical details.

Detection Methods for CVE-2025-55096

Indicators of Compromise

Unexpected USB HID devices enumerating on embedded or industrial systems that normally have fixed peripherals
USB host task crashes, watchdog resets, or firmware faults occurring shortly after a USB device is attached
Device logs showing truncated or malformed HID report descriptors during enumeration

Detection Strategies

Inventory firmware builds across your embedded fleet and flag any image linking against ThreadX USBX versions below 6.4.3
Enable verbose USB stack logging during device bring-up and in staging environments to surface descriptor parsing errors
Instrument the HID descriptor parser in test builds with address sanitization or boundary assertions to catch malformed descriptors

Monitoring Recommendations

Monitor physical-access telemetry such as badge logs and device-port alerts for environments running ThreadX-based equipment
Collect and centralize firmware crash dumps and USB stack errors into your telemetry pipeline for review
Track vendor security advisories for Eclipse ThreadX and USBX to accelerate response to related issues

How to Mitigate CVE-2025-55096

Immediate Actions Required

Upgrade Eclipse ThreadX USBX to version 6.4.3 or later and rebuild all affected firmware images
Prioritize patching for devices deployed in locations where unauthorized physical USB access is plausible
Restrict physical access to USB ports on production equipment using port blockers, enclosures, or tamper seals

Patch Information

The maintainers fixed the issue in Eclipse ThreadX USBX 6.4.3. Firmware vendors integrating USBX should pull the updated module, rebuild their images, and distribute signed firmware updates to deployed devices. Refer to the Eclipse ThreadX USBX Security Advisory for the patched commit and release notes.

Workarounds

Disable USB host functionality in firmware configurations where it is not required for the device's role
Restrict the USBX host configuration to only enumerate expected device classes and vendor or product IDs where feasible
Deploy physical USB port locks on fielded devices until a patched firmware release can be delivered

bash

# Verify the USBX version embedded in your firmware source tree
grep -R "UX_VERSION\|AZURE_RTOS_USBX\|THREADX_USBX" ./usbx/
# Confirm the version string is 6.4.3 or later before building production firmware