UBUNTU-CVE-2026-61497

Dashboard / Vulnerabilities / UBUNTU-CVE-2026-61497

UBUNTU-CVE-2026-61497

Summary:

Details: TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.

References: https://ubuntu.com/security/CVE-2026-61497, https://www.cve.org/CVERecord?id=CVE-2026-61497, https://github.com/hathach/tinyusb/commit/85047e1777f5c20b7a936aa905c746125d3ed066, https://github.com/hathach/tinyusb/releases/tag/0.21.0, https://www.vulncheck.com/advisories/tinyusb-integer-underflow-via-hid-report-descriptor-parser