No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
TinyUSB before 0.21.0 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 03 Nov 2026
- Last modified upstream: 12 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://gist.github.com/Shukhrat-03/8fe6e5881614a7f86b5d2b87d44ea706
- https://github.com/hathach/tinyusb/commit/85047e1777f5c20b7a936aa905c746125d3ed066
- https://github.com/hathach/tinyusb/releases/tag/0.21.0
- https://www.vulncheck.com/advisories/tinyusb-integer-underflow-via-hid-report-descriptor-parser
- Analysis, summary and remediation
- © VulnCrest