CVE-2025-55095
- Source
- https://cve.org/CVERecord?id=CVE-2025-55095
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55095.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-55095
- Aliases
-
- GHSA-qfmp-wch9-rpv2
- Published
- 2026-01-27T15:34:47Z
- Modified
- 2026-08-12T03:51:13Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- [none]
- Details
-
The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition.
This recursion occurs in _ux_host_class_storage_partition_read(), which parses up to four partition entries. If an extended partition is found (with type UX_HOST_CLASS_STORAGE_PARTITION_EXTENDED or EXTENDED_LBA_MAPPED), the code invokes: _ux_host_class_storage_media_mount(storage, sector + _ux_utility_long_get(...));
There is no limit on the recursion depth or tracking of visited sectors. As a result, a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.
- Database specific
{ "cna_assigner": "eclipse", "cwe_ids": [ "CWE-121", "CWE-674" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55095.json" }- References
Affected packages
Git / github.com/eclipse-threadx/usbx
Affected ranges
- Type
- GIT
- Repo
- https://github.com/eclipse-threadx/usbx
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast Affected
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:eclipse:threadx_usbx:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "6.4.2" } ], "source": [ "AFFECTED_FIELD", "CPE_RANGE" ] }