CVE-2025-55098

CVE-2025-55098 is an out-of-bounds read vulnerability in the USBX component of Eclipse Foundation ThreadX, affecting versions prior to 6.4.3. This flaw occurs during the parsing of USB audio device descriptors within the _ux_host_class_audio_device_type_get() function. Rated 6.1 MEDIUM, the vulnerability has a physical attack vector (AV:P) and low attack complexity (AC:L), requiring physical access to the device. A successful exploit could lead to high confidentiality impact (C:H) and high availability impact (A:H), potentially allowing an attacker to read sensitive data or cause a denial of service. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has garnered minimal community discussion and media coverage, indicating low public awareness.