{"id":"CVE-2026-61497","kind":"vulnerability","aliases":["CVE-2026-61497"],"related":[],"title":"TinyUSB: crafted USB device triggers out-of-bounds read and denial of service","description":"TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.","summary":"TinyUSB's HID host report descriptor parser underflows an integer when a USB device sends a truncated report descriptor, causing out-of-bounds memory reads. An attacker with a malicious USB device can crash the host system (denial of service).","severity":"medium","cvss":5.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","hid","runtime","tinyusb","usb-host"],"not_affected_if":["no-hid-host","usb-device-only"],"how_to_check":"- Check whether the project embeds TinyUSB and its version, for example by searching the source tree for `tuh_hid_parse_report_descriptor` or the TinyUSB version in your build files.\n- Confirm whether USB host HID support (`tuh_hid_parse_report_descriptor`) is compiled in and used.","fix":"- TinyUSB: move to `0.20.1` or later.","status":"open","published_at":"2026-11-03T21:17:42+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","triaged_at":"2026-11-03T21:20:45+00:00","updated_at":"2026-11-03T21:20:45+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T21:20:45Z","model":"claude-haiku-5-5","output":{"fix":"- TinyUSB: move to `0.20.1` or later.","reach":"local","title":"TinyUSB: crafted USB device triggers out-of-bounds read and denial of service","impact":"medium","summary":"TinyUSB's HID host report descriptor parser underflows an integer when a USB device sends a truncated report descriptor, causing out-of-bounds memory reads. An attacker with a malicious USB device can crash the host system (denial of service).","audience":"developers","category":"runtime","nicknames":[],"who_cares":["tinyusb","embedded","usb-host","hid"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"host crashes or reads out-of-bounds memory via a malicious USB device","analyst_note":"Confirm which downstream products embed TinyUSB HID host and whether the vendor advisory at www.vulncheck.com lists affected products.","how_to_check":"- Check whether the project embeds TinyUSB and its version, for example by searching the source tree for `tuh_hid_parse_report_descriptor` or the TinyUSB version in your build files.\n- Confirm whether USB host HID support (`tuh_hid_parse_report_descriptor`) is compiled in and used.","plain_action":"","needs_analyst":true,"not_affected_if":["usb-device-only","no-hid-host"],"who_is_affected":"Systems built on TinyUSB that act as a USB host and accept HID devices are exposed, since a plugged-in malicious device can send the crafted descriptor. Devices that only act as USB peripherals, or that do not use the HID host stack, are not in the described path. The sources do not state which products ship TinyUSB.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4269,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-61497':17A,20A '0.20.1':71C 'allow':92C 'attack':55B,124C 'bound':9A,51B,103C,150C 'buffer':123C 'caus':47B,136C 'contain':72C 'craft':2A,128C 'crash':62B 'cve':15A,18A 'denial':12A,66B,154C 'desc':140C 'descriptor':33B,46B,82C,88C,113C,135C 'devic':4A,41B,60B,96C,130C 'embed':21B 'fit':119C 'hid':22B,30B,79C,85C 'host':27B,31B,64B,80C,159C 'integ':37B,74C 'item':108C,118C 'len':141C 'length':114C 'malici':58B,94C 'memori':52B,151C 'out-of-bound':6A,48B,100C,147C 'pars':86C 'parser':34B,83C 'present':126C 'read':10A,53B,104C,152C 'remain':112C,122C 'report':32B,45B,81C,87C,134C 'result':145C 'runtim':23B 'send':42B 'servic':14A,68B,156C 'size':109C 'src/class/hid/hid_host.c':90C 'subtract':106C 'system':65B,160C 'tinyusb':1A,24B,28B,69C 'trigger':5A,98C 'truncat':44B,133C 'tuh':84C 'uint16':138C 'underflow':35B,75C,144C 'usb':3A,26B,40B,59B,95C,129C 'usb-host':25B 'valid':116C 'valu':142C 'vulner':76C 'within':120C 'without':115C","nicknames":[],"mitigations":[],"who_affected":"Systems built on TinyUSB that act as a USB host and accept HID devices are exposed, since a plugged-in malicious device can send the crafted descriptor. Devices that only act as USB peripherals, or that do not use the HID host stack, are not in the described path. The sources do not state which products ship TinyUSB.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["embedded","hid","medium","runtime","tinyusb","usbhost"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61497","severity":null,"published_at":"2026-11-03T21:17:42+00:00","modified_at":"2026-11-03T21:17:42+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","fetched_at":"2026-11-03T21:19:30+00:00","note":null}],"documents":[{"id":60897,"url":"https://github.com/hathach/tinyusb/commit/85047e1777f5c20b7a936aa905c746125d3ed066","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60898,"url":"https://github.com/hathach/tinyusb/releases/tag/0.21.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60899,"url":"https://www.vulncheck.com/advisories/tinyusb-integer-underflow-via-hid-report-descriptor-parser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}