CVE-2025-55097: Eclipse ThreadX USBX Buffer Overflow Vulnerability

CVE-2025-55097 Overview

CVE-2025-55097 is an out-of-bounds read vulnerability [CWE-125] in Eclipse ThreadX USBX, the USB support module for the Eclipse Foundation ThreadX real-time operating system. The flaw resides in the _ux_host_class_audio_streaming_sampling_get() function, which improperly parses descriptors returned by a USB streaming device. An attacker with physical access to a target embedded device can supply a malformed USB audio descriptor to trigger the out-of-bounds read. The issue affects USBX versions prior to 6.4.3 and is fixed in release 6.4.3.

Critical Impact
A malicious USB audio device connected to a vulnerable ThreadX host can cause an out-of-bounds read in the USB host stack, potentially leading to information disclosure or limited availability impact on the embedded device.

Affected Products

Eclipse ThreadX USBX versions prior to 6.4.3
Embedded devices and firmware built on Eclipse Foundation ThreadX using the vulnerable USBX host audio class
Systems that enumerate untrusted USB streaming (audio) devices via ThreadX USBX host mode

Discovery Timeline

2025-10-17 - CVE-2025-55097 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55097

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the USBX host audio class implementation. When a USB streaming device is enumerated, the host parses audio-specific descriptors to determine supported sampling frequencies. The affected function, _ux_host_class_audio_streaming_sampling_get(), reads sampling frequency entries from a device-supplied descriptor without sufficient bounds checking against the descriptor length advertised by the peripheral.

A crafted USB audio device can advertise a descriptor whose declared length or entry count does not match the buffer actually returned. When the host iterates over the sampling entries, it reads beyond the allocated buffer. The resulting read of adjacent memory can leak sensitive kernel or heap contents to the parser or cause instability in the embedded device.

Exploitation requires physical access to a USB port on the affected system. There is no authentication requirement, no user interaction beyond attaching the device, and the attack complexity is low.

Root Cause

The root cause is missing validation of descriptor length fields relative to the buffer holding the returned USB descriptor. The audio streaming class parser trusts device-supplied length metadata when walking sampling frequency records, allowing an attacker-controlled descriptor to steer reads past the end of the allocated region.

Attack Vector

An attacker physically connects a rogue USB device that emulates a USB audio class peripheral. During enumeration, the device returns a malformed audio streaming interface descriptor. The ThreadX USBX host parses the descriptor and performs the out-of-bounds read while extracting sampling frequency data. No credentials or prior compromise are required, but physical proximity to a USB port on the target embedded device is necessary.

Because no verified public proof of concept is available, refer to the Eclipse ThreadX USBX GitHub Security Advisory GHSA-r6h5-fmhc-v3j7 for authoritative technical detail.

Detection Methods for CVE-2025-55097

Indicators of Compromise

Unexpected USB audio class devices enumerated on production embedded hardware, particularly on devices without a legitimate audio use case.
Firmware crash logs, watchdog resets, or memory faults occurring shortly after USB device insertion events.
USBX host stack log entries referencing _ux_host_class_audio_streaming_sampling_get or malformed audio descriptor parsing errors.

Detection Strategies

Inventory firmware images and identify components that link against Eclipse ThreadX USBX at versions earlier than 6.4.3.
Enable descriptor validation logging in development and staging builds to catch anomalous audio class descriptors during device testing.
Correlate USB insertion events with process or task crashes in device telemetry to identify potential exploitation attempts.

Monitoring Recommendations

Monitor physical access to deployed embedded devices, including tamper-evident enclosures and port blockers for exposed USB interfaces.
Collect and centralize embedded device crash telemetry to detect repeat failures tied to USB enumeration.
Track upstream advisories from the Eclipse ThreadX USBX project for related descriptor parsing issues.

How to Mitigate CVE-2025-55097

Immediate Actions Required

Upgrade Eclipse ThreadX USBX to version 6.4.3 or later and rebuild affected firmware images.
Distribute updated firmware to all deployed devices that expose USB host interfaces to untrusted peripherals.
Restrict physical access to USB ports on production hardware where firmware updates cannot be applied immediately.

Patch Information

The vulnerability is fixed in Eclipse ThreadX USBX 6.4.3. Vendors integrating USBX must pull the fixed release, recompile firmware, and ship updates through their existing device update mechanisms. Details are published in the Eclipse ThreadX USBX Security Advisory GHSA-r6h5-fmhc-v3j7.

Workarounds

Disable the USB audio host class in the USBX build configuration if audio streaming support is not required by the product.
Deploy physical USB port locks or fill unused ports on fielded devices to block rogue peripheral attachment.
Where possible, restrict USB enumeration to an allowlist of known vendor and product IDs enforced by application-layer logic.

bash

# Configuration example: exclude the audio host class from a USBX build
# by omitting the audio class registration during host stack initialization.
# Remove or comment out the audio class registration call, for example:
# ux_host_stack_class_register(_ux_system_host_class_audio_name,
#                              ux_host_class_audio_entry);