{"id":"CVE-2026-96402","kind":"vulnerability","aliases":["CVE-2026-96402"],"related":[],"title":"USBX host: malicious MTP/PTP device reads past heap buffer","description":"A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.","summary":"A malicious USB MTP or PTP device can make the USBX host stack read beyond the end of a heap buffer while enumerating objects. The attacker can leak adjacent heap memory to the application or crash it by faulting on an unmapped page.","severity":"medium","cvss":5.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","mtp","ptp","usb-host","usbx"],"not_affected_if":["no-mtp-ptp-class","no-untrusted-usb"],"how_to_check":"- Check whether the device stack uses USBX by looking for `usbx` or `ux_host_class_pima` in the build or source tree\n- Check the USBX version in use against the fixed release named in the NVD entry (unknown from the sources)","fix":"- Update USBX to the patched release (unknown from the sources; see NVD CVE-2026-96402)\n- Until patched, unknown mitigation from the sources; restrict use of untrusted USB MTP/PTP devices","status":"open","published_at":"2026-10-20T15:17:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:28:50+00:00","updated_at":"2026-10-25T04:28:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:28:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update USBX to the patched release (unknown from the sources; see NVD CVE-2026-96402)\n- Until patched, unknown mitigation from the sources; restrict use of untrusted USB MTP/PTP devices","reach":"local","title":"USBX host: malicious MTP/PTP device reads past heap buffer","impact":"low","summary":"A malicious USB MTP or PTP device can make the USBX host stack read beyond the end of a heap buffer while enumerating objects. The attacker can leak adjacent heap memory to the application or crash it by faulting on an unmapped page.","category":"infrastructure","nicknames":[],"who_cares":["usbx","embedded","usb-host","mtp","ptp"],"confidence":0.5,"needs_auth":"no","worst_case":"Adjacent heap memory leaks to the app or the process crashes.","analyst_note":"Find the fixed USBX version and affected version range in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96402 and the upstream USBX advisory.","how_to_check":"- Check whether the device stack uses USBX by looking for `usbx` or `ux_host_class_pima` in the build or source tree\n- Check the USBX version in use against the fixed release named in the NVD entry (unknown from the sources)","needs_analyst":true,"not_affected_if":["no-mtp-ptp-class","no-untrusted-usb"],"who_is_affected":"Systems that run the USBX host stack and accept MTP or PTP devices plugged in from outside the trust boundary, such as embedded devices with USB media transfer. Systems that do not enable the USBX host PIMA/MTP class, or that never connect untrusted USB devices, are unlikely to be exposed. Desktop operating systems with their own USB stacks are not described as affected by the sources.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3286,"output_tokens":670,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-96402':12A,15A 'adjac':52B,88C 'applic':57B,93C 'attack':49B 'beyond':38B 'buffer':9A,44B,82C 'caus':73C 'content':90C 'crash':59B 'cve':10A,13A 'devic':5A,30B,71C 'embed':16B 'end':40B 'enumer':46B,86C 'fault':62B,95C 'heap':8A,43B,53B,81C,89C 'host':2A,22B,35B,76C 'infrastructur':17B 'leak':51B,87C 'make':32B 'malici':3A,25B,68C 'memori':54B 'mtp':18B,27B 'mtp/ptp':4A,70C 'object':47B,85C 'ordinari':84C 'page':66B,99C 'past':7A,79C 'ptp':19B,29B 'read':6A,37B,78C 'stack':36B 'unmap':65B,98C 'usb':21B,26B,69C 'usb-host':20B 'usbx':1A,23B,34B,75C","nicknames":[],"mitigations":[],"who_affected":"Systems that run the USBX host stack and accept MTP or PTP devices plugged in from outside the trust boundary, such as embedded devices with USB media transfer. Systems that do not enable the USBX host PIMA/MTP class, or that never connect untrusted USB devices, are unlikely to be exposed. Desktop operating systems with their own USB stacks are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96402","severity":null,"published_at":"2026-10-20T15:17:37+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}