In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclasshidreportdescriptorget()  when parsing a descriptor of an USB HID device.

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudiostreamingsamplingget() when parsing a descriptor of an USB streaming device.

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudio10samparsefunc() when parsing a list of sampling frequencies.

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudiodevicetypeget() when parsing a descriptor of an USB audio device.

In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in uxhostclassaudioalternatesettinglocate() when parsing a descriptor with attacker-controlled frequency fields.

The function uxhostclassstoragemediamount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition entry in the partition table, it recursively calls itself to mount the next logical partition.

This recursion occurs in uxhostclassstoragepartitionread(), which parses up to four partition entries. If an extended partition is found (with type UXHOSTCLASSSTORAGEPARTITIONEXTENDED or EXTENDEDLBAMAPPED), the code invokes: uxhostclassstoragemediamount(storage, sector + uxutilitylongget(...));

There is no limit on the recursion depth or tracking of visited sectors. As a result, a malicious or malformed disk image can include cyclic or excessively deep chains of extended partitions, causing the function to recurse until stack overflow occurs.