CVE-2025-55100 is a critical out-of-bounds read in USBX, the USB support module for Eclipse ThreadX. The function that parses sampling frequencies from a USB Audio Class 1.0 descriptor does not check the buffer size. Versions before 6.4.3 are affected, and 6.4.3 contains the fix.
What's affected
- Product: USBX, the USB support module for Eclipse Foundation ThreadX.
- Component:
_ux_host_class_audio10_sam_parse_func(), in the USB host audio class code. - Affected: versions up to and including 6.4.2, per the GitHub advisory.
- Fixed: 6.4.3.
The advisory says the function reads a count from the descriptor and then expects that many three byte frequency entries, with no check that the buffer contains them. A descriptor with a count larger than the real data causes a read past the end of the buffer.
This code is in the USB host stack, so it matters for devices that act as a USB host and enable the audio class driver. A device that only acts as a USB peripheral does not run this parser.
How to check if you're exposed
ThreadX modules are usually compiled into firmware, so there is no package manager to ask. Work from your build.
git submodule status
git -C path/to/module describe --tags
Run these in the repository that vendors the module, and substitute the real path. If your firmware comes from a chip vendor SDK, the SDK may carry its own copy of the module, so check the SDK release notes and ask the vendor which module version it ships. Your firmware bill of materials, if you keep one, is the quickest place to answer the question for a whole product line.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.
Also check whether your build enables the USB host audio class. If it does not, the function is not compiled in.
What to do now
- Find products that use USBX as a host stack and whether the audio class is enabled.
- Update to USBX 6.4.3 or later, rebuild and test.
- Ship a firmware update, starting with devices used in places where untrusted USB devices can be plugged in.
- If you do not need USB audio, disable the audio class in the build.
- Add physical controls where practical, such as covering unused ports on public facing equipment.
Why it matters
The weakness is an out-of-bounds read. A count taken from a device descriptor was trusted without being compared with the descriptor length. Descriptors come from the device on the other end of the cable, so an unfamiliar or tampered device controls the data.
The NVD vector rates this as network accessible, which is generous for a USB parser, since the practical attacker is someone who can attach a device. That explains why the CVSS score is high and the real exposure may be narrower. Judge urgency by whether untrusted devices can be connected to your product. This is an embedded component, which means the practical risk depends on whether the affected feature is compiled in and reachable on a given device. It is not on the CISA KEV list.
The weakness is classed as CWE-125 (Out-of-bounds Read). Severity in the CVE record: critical, CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
Quick check
Which version fixes it?
USBX 6.4.3. The advisory lists versions up to 6.4.2 as affected.
Is a USB peripheral device affected?
The affected function is in the USB host audio class code. Devices that do not use the host audio class do not run it, but check your build.
Sources
Last reviewed: 18 October 2026.
