{"id":"CVE-2026-96406","kind":"vulnerability","aliases":["CVE-2026-96406"],"related":[],"title":"USBX host: oversized VideoStreaming descriptor length lets device read past buffer","description":"A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received.\n\n\n\nA device that reports a `wTotalLength` larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.","summary":"The USBX USB host stack trusts a VideoStreaming interface's wTotalLength field without checking it against the configuration descriptor actually received. A malicious USB device can make the host read past the end of its configuration buffer when the application queries format or frame data.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","runtime","usb-host","usbx","uvc"],"not_affected_if":["no-usb-host-stack","trusted-devices-only"],"how_to_check":"- Check whether the project uses the USBX host stack and the USB Video Class (UVC) host driver, for example with `grep -ri usbx` in the source tree or build files.\n- Compare the USBX version against the fixed release named in the advisory (unknown in the sources).","fix":"- Update USBX to a release that validates wTotalLength against the received configuration descriptor (fixed version unknown in the sources).\n- Until patched, avoid attaching untrusted USB video devices to affected hosts.","status":"open","published_at":"2026-10-20T14:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:32:50+00:00","updated_at":"2026-10-25T04:32:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:32:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update USBX to a release that validates wTotalLength against the received configuration descriptor (fixed version unknown in the sources).\n- Until patched, avoid attaching untrusted USB video devices to affected hosts.","reach":"local","title":"USBX host: oversized VideoStreaming descriptor length lets device read past buffer","impact":"medium","summary":"The USBX USB host stack trusts a VideoStreaming interface's wTotalLength field without checking it against the configuration descriptor actually received. A malicious USB device can make the host read past the end of its configuration buffer when the application queries format or frame data.","category":"runtime","nicknames":[],"who_cares":["usbx","embedded","usb-host","uvc"],"confidence":0.6,"needs_auth":"no","worst_case":"Host reads memory beyond the configuration buffer, possibly leaking data or crashing.","analyst_note":"Find the fixed USBX version and the NVD/vendor advisory text to confirm the affected range and any memory-corruption versus read-only impact.","how_to_check":"- Check whether the project uses the USBX host stack and the USB Video Class (UVC) host driver, for example with `grep -ri usbx` in the source tree or build files.\n- Compare the USBX version against the fixed release named in the advisory (unknown in the sources).","needs_analyst":true,"not_affected_if":["no-usb-host-stack","trusted-devices-only"],"who_is_affected":"Systems running the USBX host stack with USB Video Class support that accept arbitrary USB devices. Devices and hosts that never enable USB host mode with the video class, or that only use trusted peripherals, are less exposed. The sources do not name a specific product list.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000652,"input_tokens":3411,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96406':14A,17A 'actual':44B,121C 'applic':64B,168C 'believ':140C 'block':83C 'budget':103C 'buffer':11A,61B,160C 'byte':144C 'check':38B 'claim':139C 'class':80C 'class-specif':79C 'configur':42B,60B,119C,159C 'context':165C 'cursor':153C 'cve':12A,15A 'data':69B,173C 'dereferenc':151C 'descriptor':5A,43B,82C,113C,120C,132C 'devic':8A,49B,124C 'embed':18B 'end':57B,156C 'field':36B,87C 'figur':97C 'format':66B,107C,170C 'frame':68B,108C,111C,172C 'frame-interv':110C 'go':150C 'header':91C 'hold':115C 'host':2A,22B,28B,53B,94C,163C 'input':90C 'interfac':33B,72C 'interv':112C 'kept':149C 'larger':129C 'length':6A 'let':7A 'make':51B 'malici':47B 'overs':3A 'past':10A,55B,154C 'queri':65B,169C 'ran':145C 'read':9A,54B 'real':143C 'receiv':45B,122C 'record':95C 'report':73C,126C 'runtim':19B 'size':75C 'specif':81C 'stack':29B 'suppli':134C 'therefor':135C 'trust':30B 'usb':21B,27B,48B 'usb-host':20B 'usbx':1A,23B,26B,93C 'use':99C 'uvc':24B 'videostream':4A,32B,71C 'walk':105C,148C 'whenev':166C 'whole':78C 'without':37B,114C 'wtotallength':35B,86C,128C","nicknames":[],"mitigations":[],"who_affected":"Systems running the USBX host stack with USB Video Class support that accept arbitrary USB devices. Devices and hosts that never enable USB host mode with the video class, or that only use trusted peripherals, are less exposed. The sources do not name a specific product list.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96406","severity":null,"published_at":"2026-10-20T14:17:04+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}