The vulnerability lies in the USBX host’s parsing of HID report descriptors. A descriptor header declares how many data bytes follow, but the implementation checks that an item fits only after it has already advanced past the header and parsed the payload. When a HID peripheral supplies an incomplete or truncated descriptor, this logic permits a heap out‑of‑bounds read during normal device enumeration, potentially exposing adjacent memory contents to an attacker. The flaw is a classic out‑of‑bounds read (CWE‑125) and a lack of data size validation (CWE‑1285).

This issue affects the Eclipse ThreadX USBX component provided by the Eclipse Foundation. Exact affected release versions are not supplied, so all current versions of the USBX HID report descriptor parser should be treated as vulnerable until a patch is released.

The CVSS score of 4.9 indicates moderate severity. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. The likely attack vector involves a malicious USB peripheral that can supply a malformed report descriptor to the host; the vulnerability is exploitable during ordinary device enumeration in systems that support HID devices. Because the flaw only causes a read, attackers can gain information from memory, which may aid further exploitation but does not provide direct code execution. The overall risk is moderate, and the threat remains contained to environments that process external USB HID devices.