TinyUSB before 0.21.0 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Hathach |
|
No data.
No data.
References
History
Mon, 09 Nov 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system. | TinyUSB before 0.21.0 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system. |
| Title | TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser | TinyUSB < 0.21.0 Integer Underflow via HID Report Descriptor Parser |
| References |
|
Sun, 08 Nov 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 06 Nov 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Hathach
Hathach tinyusb |
|
| Vendors & Products |
Hathach
Hathach tinyusb |
Tue, 03 Nov 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system. | |
| Title | TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser | |
| Weaknesses | CWE-191 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-11-03T20:21:53.640Z
Updated: 2026-11-09T21:59:12.227Z
Reserved: 2026-07-10T15:43:36.625Z
Link: CVE-2026-61497
Vulnrichment
Updated: 2026-11-03T21:28:07.138Z
NVD
Status : Received
Published: 2026-11-03T21:17:42.723
Modified: 2026-11-09T22:18:52.840
Link: CVE-2026-61497
Redhat
No data.