PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-96406 Eclipse Foundation CVE debrief

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received. A device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.

Vendor
Eclipse Foundation
Product
Eclipse ThreadX - USBX
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for Eclipse ThreadX - USBX deployments should assess exposure and verify versions in use, as the vulnerability allows for potential denial of service or information disclosure.

Why it matters

Defenders should prioritize verifying the versions of Eclipse ThreadX - USBX in use and assessing exposure, as the vulnerability allows for a medium-severity issue with potential for denial of service or information disclosure. The vulnerability requires verification from official sources, and remediation priority follows from verifying and updating configurations.

  • Denial of service due to dereferencing past the end of the configuration buffer
  • Potential information disclosure due to querying format or frame data

Technical summary

The vulnerability occurs in the VideoStreaming interface of Eclipse ThreadX - USBX, where the `wTotalLength` field of the input header is used as a bound for walking the format, frame and frame-interval descriptors. A device can report a `wTotalLength` larger than the descriptors it supplies, causing the host to dereference the cursor past the end of the configuration buffer. This vulnerability allows for potential denial of service or information disclosure, and requires verification from official sources. Defenders should prioritize verifying the versions of Eclipse ThreadX - USBX in use and assessing exposure.

Defensive priority

Defenders should prioritize verifying the versions of Eclipse ThreadX - USBX in use and assessing exposure, as the vulnerability allows for a medium-severity issue with potential for denial of service or information disclosure.

Recommended defensive actions

  • Verify the version of Eclipse ThreadX - USBX in use and assess exposure
  • Review and update configurations to prevent device-controlled wTotalLength from being used as a bound
  • Monitor for potential denial of service or information disclosure
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. The source item and supplemental source reference offer additional context. Defenders should verify the versions of Eclipse ThreadX - USBX in use and assess exposure based on the official CVE Program record and NVD vulnerability detail. The source item provides VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound. However, the CVE Program record has limited source detail, so defenders must consult official

Sources and references

Verified primary and authoritative sources

  • CVE-2026-96406 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-96406

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-96406 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-96406

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.