Is CVE-2026-96402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96402 being exploited in the wild.

How severe is CVE-2026-96402?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Eclipse Foundation ThreadX USBX <= 6.5.1.202602.

How is CVE-2026-96402 attacked?

It is attacked with physical access, in a software library.

Am I affected by CVE-2026-96402?

Check whether you run Eclipse Foundation ThreadX USBX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96402: Eclipse ThreadX USBX heap buffer over-read in PIMA/MTP host

Q: Is there a fix for CVE-2026-96402?

Yes: fixed in 6.5.2.202603. Until then: Do not enumerate untrusted or unknown MTP/PTP USB devices. Restrict physical USB access to trusted devices only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96402 attacked?

It is attacked with physical access, in a software library.

Q: Am I affected by CVE-2026-96402?

Check whether you run Eclipse Foundation ThreadX USBX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96402 · Severity: info · Published 2026-10-20

Eclipse ThreadX USBX is a USB device stack used in embedded systems. A malicious or compromised USB MTP/PTP device (like a fake camera or phone) can cause the host to read past a heap buffer during object enumeration, leaking sensitive heap memory to applications or crashing the system. The attack requires only physical connection and enumeration; no special user action is needed.

Vendors: Eclipse Foundation.

Quick answers

Is CVE-2026-96402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96402 being exploited in the wild.
How severe is CVE-2026-96402?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Eclipse Foundation ThreadX USBX <= 6.5.1.202602.
Is there a fix for CVE-2026-96402?: Yes: fixed in 6.5.2.202603. Until then: Do not enumerate untrusted or unknown MTP/PTP USB devices. Restrict physical USB access to trusted devices only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96402 attacked?: It is attacked with physical access, in a software library.
Am I affected by CVE-2026-96402?: Check whether you run Eclipse Foundation ThreadX USBX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.5.2.202603

Do not enumerate untrusted or unknown MTP/PTP USB devices. Restrict physical USB access to trusted devices only.

Technical details

The PIMA/MTP host class functions (_ux_host_class_pima_object_handles_get, _ux_host_class_pima_device_info_get, _ux_host_class_pima_object_info_get, and _ux_host_class_pima_storage_info_get) read device-controlled counts and lengths from USB responses into fixed-size buffers without validating them against buffer boundaries. A device that reports inflated object handle counts or array lengths causes the source cursor to walk past its heap allocation. Attack vector is physical (USB attachment) with required user interaction (enumeration), allowing information disclosure and denial of service.

Affected products

Eclipse Foundation ThreadX USBX <= 6.5.1.202602

Timeline

2026-10-02: disclosed
2026-10-20: patched

References

https://github.com/eclipse-threadx/usbx/security/advisories/GHSA-2ch9-p8xv-fwp6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.