Live › vulnerability › CVE-2026-96406
Go to dashboardThe USBX USB host stack trusts a VideoStreaming interface's wTotalLength field without checking it against the configuration descriptor actually received. A malicious USB device can make the host read past the end of its configuration buffer when the application queries format or frame data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the USBX host stack with USB Video Class support that accept arbitrary USB devices. Devices and hosts that never enable USB host mode with the video class, or that only use trusted peripherals, are less exposed. The sources do not name a specific product list.
No product ranges from the sources yet.
grep -ri usbx in the source tree or build files.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received.
A device that reports a wTotalLength larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.
This page as .md · .json · in your agent: get_signal("CVE-2026-96406")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.