CVE-2026-96406
Received Received - Intake

USB Descriptor Length Validation Flaw in Microsoft USBX

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received. A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-96406
EUVD
EUVD-2026-105002

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ThreadX - USBX 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a VideoStreaming interface in Eclipse ThreadX's USBX library that incorrectly uses a device-controlled value called wTotalLength as the limit for parsing format, frame, and frame-interval descriptors. When a malicious or malfunctioning UVC device reports a larger wTotalLength than the actual descriptors it provides, the host reads beyond the configuration buffer, causing out-of-bounds reads that may expose heap data or trigger faults.

Detection Guidance

Detecting this vulnerability requires checking the USBX library version and monitoring for out-of-bounds reads during USB Video Class (UVC) device interactions. Verify if your system uses USBX versions up to 6.5.1.202602. Use commands like 'grep' to inspect library versions or 'dmesg' for kernel logs showing buffer overflow errors during UVC device interactions.

Impact Analysis

This vulnerability requires physical attachment of a malicious or malfunctioning UVC device and interaction with an application that queries format or frame data. It can lead to out-of-bounds reads, potentially exposing sensitive heap data or causing system faults, crashes, or instability in the host system.

Mitigation Strategies

Upgrade USBX to version 6.5.2.202603 or later to patch the vulnerability. Avoid connecting untrusted UVC devices to prevent exploitation. If upgrading is not immediately possible, restrict physical access to USB ports and monitor for suspicious device interactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96406. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart