CVE-2026-96582 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for Eclipse ThreadX - USBX deployments should assess exposure and prioritize upgrading to version 6.5.2.202603 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify inventory and ensure that affected systems are upgraded to the patched version.

Why it matters

Defenders should care about CVE-2026-96582 because it affects Eclipse ThreadX - USBX versions 6.5.1.202602 and earlier, potentially leading to a heap out-of-bounds read during ordinary enumeration. The issue was addressed in version 6.5.2.202603, and defenders should prioritize verifying inventory and upgrading to this version or later.

• Potential heap out-of-bounds read during enumeration
• Possible exposure of sensitive information
• Need for verification of inventory and upgrade to patched version

Technical summary

The USBX host walks a HID report descriptor sequence by advancing over each header and parsing the data behind it. However, the walk checked that an item fitted in the descriptor only after it had advanced past the header and parsed the payload. This led to a heap out-of-bounds read during ordinary enumeration. The issue was addressed in version 6.5.2.202603. Defenders should prioritize verifying inventory and upgrading to this version or later. The vulnerability affects Eclipse ThreadX - USBX versions 6.5.1.202602 and earlier.

Defensive priority

Defenders should prioritize verifying inventory and upgrading to version 6.5.2.202603 or later.

Recommended defensive actions

• Verify inventory of Eclipse ThreadX - USBX versions
• Upgrade to version 6.5.2.202603 or later
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail page provide official information about this vulnerability. The issue affects Eclipse ThreadX - USBX versions 6.5.1.202602 and earlier. The CVE record was published on 2026-10-20T13:13:39.177Z and has not been modified since then. There is no evidence of exploitation in the wild, but defenders should verify inventory and prioritize upgrading to version 6.5.2.202603 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.