Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-61495

TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Hathach
Products
Tinyusb
CVE-2026-61497

TinyUSB < 0.21.0 Integer Underflow via HID Report Descriptor Parser

TinyUSB before 0.21.0 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hathach
Products
Tinyusb