Live › vulnerability › CVE-2026-61495
TinyUSB's MTP device class helper copies up to 510 bytes from a crafted string into a fixed-size buffer without bounds checks. A malicious USB host can corrupt adjacent memory, which may lead to code execution or a denial of service on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Only devices that build TinyUSB with the MTP device class enabled and accept a USB connection from an untrusted host are exposed. The flaw sits in the device side, so a team that only uses TinyUSB as a host stack or without MTP can skip it. The sources do not say which boards or firmware are most common.
No product ranges from the sources yet.
src/class/mtp/mtp.h in the build)unknown if the sources do not say how to read it from a given projecte85c2b8; the sources do not name a released versione85c2b8 (version unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.
This page as .md · .json · in your agent: get_signal("CVE-2026-61495")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.