# CVE-2026-96406: Eclipse ThreadX USBX VIDEO descriptor buffer over-read

Source: https://junglewise.ai/threats/cve-2026-96406-a-videostreaming-interface-reports-the-size-of-its-whole-class  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-96406 · Severity: medium · CVSS 4.9 · Published 2026-10-20

Eclipse ThreadX USBX is a USB host stack used in embedded systems to communicate with USB devices. A malicious or malfunctioning USB video device can trigger a buffer over-read by reporting a descriptor size larger than the data it actually provides, potentially causing information disclosure or system crashes when the host queries video format or frame information.

Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-96406 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96406 being exploited in the wild.

**How severe is CVE-2026-96406?** Medium severity, with a CVSS score of 4.9, published 20 October 2026.

**Which products and versions are affected?** Eclipse ThreadX USBX <= 6.5.1.202602.

**Is there a fix for CVE-2026-96406?** Yes: fixed in USBX 6.5.2.202603. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96406 attacked?** It is attacked with physical access.

**Am I affected by CVE-2026-96406?** Check whether you run Eclipse ThreadX USBX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in USBX 6.5.2.202603

## Technical details

The USBX VIDEO class driver uses a device-supplied wTotalLength field as the loop bound when walking format, frame, and frame-interval descriptors, without validating this value against the actual configuration buffer size. An attacker-controlled USB device can report a wTotalLength exceeding the descriptors provided, causing the descriptor walk to read past the configuration buffer boundary in the host's memory. Exploitation requires device attachment, enumeration, and the application to query format or frame data, which is typical usage.

## Affected products

- Eclipse ThreadX USBX <= 6.5.1.202602

## Timeline

- 2026-10-02: disclosed
- 2026-10-20: advisory

## References

- [https://github.com/eclipse-threadx/usbx/security/advisories/GHSA-8qf6-hjvf-g68f](https://github.com/eclipse-threadx/usbx/security/advisories/GHSA-8qf6-hjvf-g68f)

## Related threats

- [USBX HID report descriptor out-of-bounds read](https://junglewise.ai/threats/cve-2026-96582-a-hid-report-descriptor-is-a-sequence-of-items-each-declaring-in)