CVE-2026-96406

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-96406

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96406.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-96406

Aliases

GHSA-8qf6-hjvf-g68f

Published

2026-10-20T13:17:37Z

Modified

2026-10-21T03:00:21Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVSS Calculator

Summary

VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

Details

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received.

A device that reports a wTotalLength larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.

Database specific

{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96406.json"
}

References

Affected packages

Git / github.com/eclipse-threadx/usbx

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/usbx

Events

Introduced

Last Affected

359977dd98d797fa3c93d0dda71cdbb29820fdc1

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "6.5.1.202602"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v.*

v.6.4.3.2025_rel

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.2_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3.202503_rel

v6.4.5.202504_rel

v6.4.5.202504a_rel

v6.5.0.202601_rel

v6.5.1.202602_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96406.json"