---
id: "CVE-2026-61495"
kind: "vulnerability"
aliases: ["CVE-2026-61495"]
title: "TinyUSB: MTP string parsing lets a USB host overwrite memory"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "mtp", "runtime", "tinyusb", "usb"]
not_affected_if: ["mtp-class-disabled", "usb-host-trusted"]
published_at: "2026-11-03T21:17:42+00:00"
first_seen_at: "2026-11-03T21:19:30+00:00"
updated_at: "2026-11-03T21:20:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61495", "first_seen_at": "2026-11-03T21:19:30+00:00"}]
---

# TinyUSB: MTP string parsing lets a USB host overwrite memory

TinyUSB's MTP device class helper copies up to 510 bytes from a crafted string into a fixed-size buffer without bounds checks. A malicious USB host can corrupt adjacent memory, which may lead to code execution or a denial of service on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the firmware builds TinyUSB with the MTP device class enabled (look for `src/class/mtp/mtp.h` in the build)
- Check the TinyUSB version in use: `unknown` if the sources do not say how to read it from a given project

## Fix

- TinyUSB: a fix is in commit `e85c2b8`; the sources do not name a released version
- Upgrade to a TinyUSB release that includes commit `e85c2b8` (version unknown)

## Timeline

- 2026-11-03T21:19:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61495

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string
- [fix] Patch: github.com https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9

## From the sources

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_