CVE-2026-96402: USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

Published Oct 20, 2026

Updated

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.

Affected Software

1 affected component

Eclipse Threadx Usbx

Event History

Oct 20, 2026

CVE Published

via MITRE·02:31 PM

Data Sourced

via MITRE·02:31 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to trigger the issue?

The attacker needs physical access to present a malicious USB MTP/PTP device. Exploitation occurs during object enumeration and requires user interaction.

What are the practical consequences of successful exploitation?

The application may receive adjacent heap contents, exposing data in memory. The host can also fault if the out-of-bounds read reaches an unmapped page, causing an availability impact.

CVE-2026-96402: USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to trigger the issue?

What are the practical consequences of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the issue?

What are the practical consequences of successful exploitation?