A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer when it enumerates objects, leading to leakage of adjacent heap contents or a fault on an unmapped page. This over-read vulnerability is triggered during normal device operation and can expose data that should remain private to the USB host application or cause a denial of service by crashing the host. The flaw is a classic heap read‑past‑end over‑read (CWE‑125).

The vulnerability affects versions of the Eclipse ThreadX USBX host class provided by the Eclipse Foundation that implement the PIMA/MTP protocol. No specific sub‑version numbers are listed in the advisory, so all builds that include the affected code are potentially impacted until verified otherwise by the vendor or an updated patch.

The CVSS score of 5.2 indicates a moderate risk. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The likely attack vector is through a physical USB MTP/PTP device that over‑reports its object handle count to trigger the over‑read. Because the attacker must connect a USB device to the host, the vulnerability is best understood as a local fault that could be leveraged for information leakage or by an attacker with physical access to the system. The absence of a public exploitation reference and the moderate severity suggest that conservatively applying the vendor patch remains the primary defense.