{"id":"CVE-2026-116776","kind":"vulnerability","aliases":["CVE-2026-116776"],"related":[],"title":"USB Test: malicious USB drive can corrupt heap and run code","description":"USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), &sector, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.","summary":"USB Test, a Windows command-line tool for checking USB flash drives, trusts the sector size a drive reports without validating it. A malicious USB storage device can report a tiny or zero sector size, causing heap out-of-bounds writes that crash the elevated app or may allow arbitrary code execution.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","usb-test","windows"],"not_affected_if":["no-untrusted-usb-drives","version-1.1.5-or-later"],"how_to_check":"- Run the USB Test binary and check its version against `1.1.5`\n- Look for the USB Test install on Windows machines used to test USB drives, and note the version","fix":"- Upgrade USB Test to `1.1.5` or later","status":"open","published_at":"2026-10-28T16:17:06+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:54+00:00","updated_at":"2026-10-28T16:35:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T16:35:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade USB Test to `1.1.5` or later","reach":"local","title":"USB Test: malicious USB drive can corrupt heap and run code","impact":"high","summary":"USB Test, a Windows command-line tool for checking USB flash drives, trusts the sector size a drive reports without validating it. A malicious USB storage device can report a tiny or zero sector size, causing heap out-of-bounds writes that crash the elevated app or may allow arbitrary code execution.","category":"package","nicknames":[],"who_cares":["windows","usb-test"],"confidence":0.7,"needs_auth":"no","worst_case":"Elevated app crashes; possible code execution via heap corruption","analyst_note":"","how_to_check":"- Run the USB Test binary and check its version against `1.1.5`\n- Look for the USB Test install on Windows machines used to test USB drives, and note the version","needs_analyst":false,"not_affected_if":["version-1.1.5-or-later","no-untrusted-usb-drives"],"who_is_affected":"Teams that run USB Test on Windows to verify flash drives are exposed when they start a drive test on a device they did not trust. The exposure comes from the physically attached USB storage device reporting a bad sector size, so only machines that run the test against untrusted drives matter. Teams that never run this tool, or only test drives they control, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3533,"output_tokens":506,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116776':14A,17A '-2026':13A,16A '1.1.5':100C,205C '8':141C 'allow':73B 'app':70B 'applic':192C 'arbitrari':74B,196C 'bound':64B,123C,163C 'buffer':136C 'buffer.data':139C 'byte':156C 'call':118C 'capac':92C 'caus':59B,158C,169C 'check':32B,115C 'cli':83C 'code':11A,75B,197C 'command':28B 'command-lin':27B 'connect':145C 'corrupt':7A,187C 'crash':67B,189C 'cve':12A,15A 'denial':175C 'detect':90C 'devic':50B,149C 'disk':110C 'disk_geometry.bytespersector':106C 'divid':172C 'divide-by-zero':171C 'divis':130C 'drive':5A,35B,41B,96C,112C,183C 'eight':155C 'elev':69B,191C 'enforc':121C 'execut':76B,198C 'fix':202C 'flash':34B,95C 'geometri':113C 'get':111C 'getsectors':101C 'heap':8A,60B,135C,186C 'integr':88C 'ioctl':109C 'issu':200C 'lightweight':81C 'line':29B 'malici':3A,47B,146C 'may':72B,194C 'memcpi':138C 'out-of-bound':61B,160C 'overreport':91C 'packag':18B 'permit':195C 'physic':144C 'prior':97C 'repeat':159C 'report':42B,52B,151C,166C 'return':107C 'run':10A 'sector':38B,57B,87C,140C 'servic':177C 'size':39B,58B,122C,133C 'start':181C 'storag':49B,148C 'succeed':119C 'test':2A,21B,24B,78C,184C 'test/src/driveinfo.cpp':104C 'test/src/drivetest.cpp':125C 'tini':54B 'tool':30B 'trust':36B,105C 'usb':1A,4A,20B,23B,33B,48B,77C,94C,103C,124C,147C 'usb-test':19B 'use':126C 'user':180C 'util':84C 'valid':44B 'valu':128C,153C 'verifi':86C 'version':99C,204C 'whether':116C 'window':22B,26B,82C 'without':43B,114C 'write':65B,164C 'zero':56B,167C,174C","nicknames":[],"mitigations":[],"who_affected":"Teams that run USB Test on Windows to verify flash drives are exposed when they start a drive test on a device they did not trust. The exposure comes from the physically attached USB storage device reporting a bad sector size, so only machines that run the test against untrusted drives matter. Teams that never run this tool, or only test drives they control, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116776","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116776","severity":null,"published_at":"2026-10-28T16:17:06+00:00","modified_at":"2026-10-28T16:17:06+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}