CVE-2026-96582
Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
- Published
- Updated
- Reserved
- Assigned by
- eclipse
Description
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only **after** it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| eclipseCNA (assigner) | 3.1 | Medium4.9 | CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | Medium4.9 | CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.9.
Weakness
Affected products
Eclipse Foundation · Eclipse ThreadX - USBX
- affected ≤ 6.5.1.202602
- unaffected 6.5.2.202603
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-96582)Record last updated .