{"id":"CVE-2026-61495","kind":"vulnerability","aliases":["CVE-2026-61495"],"related":[],"title":"TinyUSB: MTP string parsing lets a USB host overwrite memory","description":"TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.","summary":"TinyUSB's MTP device class helper copies up to 510 bytes from a crafted string into a fixed-size buffer without bounds checks. A malicious USB host can corrupt adjacent memory, which may lead to code execution or a denial of service on the device.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","mtp","runtime","tinyusb","usb"],"not_affected_if":["mtp-class-disabled","usb-host-trusted"],"how_to_check":"- Check whether the firmware builds TinyUSB with the MTP device class enabled (look for `src/class/mtp/mtp.h` in the build)\n- Check the TinyUSB version in use: `unknown` if the sources do not say how to read it from a given project","fix":"- TinyUSB: a fix is in commit `e85c2b8`; the sources do not name a released version\n- Upgrade to a TinyUSB release that includes commit `e85c2b8` (version unknown)","status":"open","published_at":"2026-11-03T21:17:42+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","triaged_at":"2026-11-03T21:20:41+00:00","updated_at":"2026-11-03T21:20:41+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:20:41Z","model":"claude-haiku-5-5","output":{"fix":"- TinyUSB: a fix is in commit `e85c2b8`; the sources do not name a released version\n- Upgrade to a TinyUSB release that includes commit `e85c2b8` (version unknown)","reach":"local","title":"TinyUSB: MTP string parsing lets a USB host overwrite memory","impact":"high","summary":"TinyUSB's MTP device class helper copies up to 510 bytes from a crafted string into a fixed-size buffer without bounds checks. A malicious USB host can corrupt adjacent memory, which may lead to code execution or a denial of service on the device.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["tinyusb","embedded","usb","mtp"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"malicious USB host corrupts device memory, possibly running code","analyst_note":"Confirm the fixed release version containing commit e85c2b8 and the exact affected build configuration from the linked patch and VulnCheck advisory.","how_to_check":"- Check whether the firmware builds TinyUSB with the MTP device class enabled (look for `src/class/mtp/mtp.h` in the build)\n- Check the TinyUSB version in use: `unknown` if the sources do not say how to read it from a given project","plain_action":"","needs_analyst":true,"not_affected_if":["mtp-class-disabled","usb-host-trusted"],"who_is_affected":"Only devices that build TinyUSB with the MTP device class enabled and accept a USB connection from an untrusted host are exposed. The flaw sits in the device side, so a team that only uses TinyUSB as a host stack or without MTP can skip it. The sources do not say which boards or firmware are most common.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4258,"output_tokens":643,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61495':13A,16A '0.21.0':70C '510':31B,126C 'achiev':136C 'adjac':52B,103C 'allow':96C 'attack':116C 'bound':44B,80C 'buffer':42B,134C 'byte':32B,127C 'caus':140C 'charact':114C 'check':45B 'class':26B,87C 'code':58B,137C 'commit':73C 'contain':75C,90C 'copi':28B,123C 'corrupt':51B,102C 'count':115C 'craft':35B,108C 'cve':11A,14A 'denial':62B,142C 'destin':133C 'devic':25B,67B,86C,149C 'e85c2b8':74C 'embed':17B 'execut':59B,138C 'exploit':118C 'fix':40B,71C,131C 'fixed-s':39B,130C 'get':91C 'helper':27B,88C 'host':8A,49B,100C 'lead':56B 'let':5A 'malici':47B,98C 'may':55B 'memcpi':121C 'memori':10A,53B,104C 'mtp':2A,18B,24B,85C,89C,109C,148C 'oper':122C 'out-of-bound':77C 'overwrit':9A 'pars':4A 'runtim':19B 'servic':64B,144C 'size':41B,132C 'src/class/mtp/mtp.h':94C 'string':3A,36B,92C,110C 'suppli':106C 'tinyusb':1A,20B,22B,68C,147C 'unbound':113C 'uncheck':120C 'usb':7A,21B,48B,99C 'vulner':82C 'without':43B 'write':81C","nicknames":[],"mitigations":[],"who_affected":"Only devices that build TinyUSB with the MTP device class enabled and accept a USB connection from an untrusted host are exposed. The flaw sits in the device side, so a team that only uses TinyUSB as a host stack or without MTP can skip it. The sources do not say which boards or firmware are most common.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","high","mtp","runtime","tinyusb","usb"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61495","severity":null,"published_at":"2026-11-03T21:17:42+00:00","modified_at":"2026-11-03T21:17:42+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","fetched_at":"2026-11-03T21:19:30+00:00","note":null}],"documents":[{"id":60895,"url":"https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60896,"url":"https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}