Live › vulnerability › CVE-2026-61497
TinyUSB's HID host report descriptor parser underflows an integer when a USB device sends a truncated report descriptor, causing out-of-bounds memory reads. An attacker with a malicious USB device can crash the host system (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Systems built on TinyUSB that act as a USB host and accept HID devices are exposed, since a plugged-in malicious device can send the crafted descriptor. Devices that only act as USB peripherals, or that do not use the HID host stack, are not in the described path. The sources do not state which products ship TinyUSB.
No product ranges from the sources yet.
tuh_hid_parse_report_descriptor or the TinyUSB version in your build files.tuh_hid_parse_report_descriptor) is compiled in and used.0.20.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.
This page as .md · .json · in your agent: get_signal("CVE-2026-61497")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.