CVE-2025-55095
- Source
- https://cve.org/CVERecord?id=CVE-2025-55095
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55095.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-55095
- Aliases
-
- GHSA-qfmp-wch9-rpv2
- Published
- 2026-01-27T15:34:47.755Z
- Modified
- 2026-07-15T01:49:20.358085467Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- [none]
- Details
-
The function uxhostclassstoragemediamount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition.
This recursion occurs in uxhostclassstoragepartitionread(), which parses up to four partition entries. If an extended partition is found (with type UXHOSTCLASSSTORAGEPARTITIONEXTENDED or EXTENDEDLBAMAPPED), the code invokes: uxhostclassstoragemediamount(storage, sector + uxutilitylong_get(...));
There is no limit on the recursion depth or tracking of visited sectors. As a result, a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.
- Database specific
{ "cna_assigner": "eclipse", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55095.json", "cwe_ids": [ "CWE-121", "CWE-674" ] }- References
Affected packages
Git / github.com/eclipse-threadx/usbx
Affected ranges
- Type
- GIT
- Repo
- https://github.com/eclipse-threadx/usbx
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected
- Database specific
{ "cpe": "cpe:2.3:a:eclipse:threadx_usbx:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "6.4.2" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }