How do I check whether I am affected by CVE-2026-96402?

- Check whether the device stack uses USBX by looking for `usbx` or `ux_host_class_pima` in the build or source tree - Check the USBX version in use against the fixed release named in the NVD entry (unknown from the sources)

What is the fix for CVE-2026-96402?

- Update USBX to the patched release (unknown from the sources; see NVD CVE-2026-96402) - Until patched, unknown mitigation from the sources; restrict use of untrusted USB MTP/PTP devices

Who is not affected by CVE-2026-96402?

Not affected if: no-mtp-ptp-class, no-untrusted-usb.

Live › vulnerability › CVE-2026-96402

Go to dashboard

medium5.2Infrastructure

USBX host: malicious MTP/PTP device reads past heap buffer

A malicious USB MTP or PTP device can make the USBX host stack read beyond the end of a heap buffer while enumerating objects. The attacker can leak adjacent heap memory to the application or crash it by faulting on an unmapped page.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

5.2

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 20, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: local.
Worst case: Adjacent heap memory leaks to the app or the process crashes.
CVSS said: 5.2. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Systems that run the USBX host stack and accept MTP or PTP devices plugged in from outside the trust boundary, such as embedded devices with USB media transfer. Systems that do not enable the USBX host PIMA/MTP class, or that never connect untrusted USB devices, are unlikely to be exposed. Desktop operating systems with their own USB stacks are not described as affected by the sources.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-96402

Go to dashboard

medium5.2Infrastructure

USBX host: malicious MTP/PTP device reads past heap buffer

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

5.2

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 20, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Yes.
Reachable from: local.
Worst case: Adjacent heap memory leaks to the app or the process crashes.
CVSS said: 5.2. The facts above say low; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

USBX host: malicious MTP/PTP device reads past heap buffer

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

USBX host: malicious MTP/PTP device reads past heap buffer

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources