The vulnerability is in the USBX host stack for Eclipse ThreadX. A VideoStreaming interface reports the total length of its descriptors in the wTotalLength field of the header. The USBX code records this size and uses it as the maximum index when walking through the format, frame, and frame‑interval descriptors. Because no comparison is made against the actual length of the configuration descriptor that was received, a device that supplies a wTotalLength larger than the real buffer can trigger an out‑of‑bounds read when the host continues walking past the end of the configuration buffer. The overread occurs while the host processes queries for format or frame data, and occurs in the host's context, potentially allowing a malicious USB peripheral to cause a crash or read unintended memory. The impact matches CWE‑125: Out‑of‑Bounds Read and may result in denial of service or information disclosure.

Eclipse ThreadX – USBX is affected. No specific version information is provided, so all builds that contain the current USBX VideoStreaming implementation are considered potentially vulnerable. The vulnerability is triggered by an external USB device that reports a wTotalLength larger than the actual descriptor block it supplies. Users running ThreadX devices that might receive untrusted USB input should verify whether the affected code path is used.

The CVSS score is 4.9, indicating a moderate risk. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a malicious or misbehaving USB peripheral that supplies a descriptor block with a crafted wTotalLength field, so the vulnerability is exploitable from external device access. When triggered, the host will read past the end of the buffer in user context, which could lead to a crash (Denial of Service) or exposure of internal memory.