CVE-2026-61495

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtpcontainergetstring in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character coun...

CVE-2026-61497

TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuhhidparsereportdescriptor in src/class/hid/hidhost.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length...

CVE-2026-61497

TinyUSB versions before 0.20.1 are vulnerable to an integer underflow in the tuh_hid_parse_report_descriptor() function located in src/class/hid/hid_host.c. The flaw occurs because the parser subtracts an item size from the remaining descriptor length without validating if the item fits within th...

CVE-2026-61497 TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser

TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuhhidparsereportdescriptor in src/class/hid/hidhost.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length...

EUVD-2026-116215

TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuhhidparsereportdescriptor in src/class/hid/hidhost.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length...

CVE-2026-61495 TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtpcontainergetstring in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character coun...

CVE-2026-61495

TinyUSB versions through 0.21.0 are vulnerable to an out-of-bounds write in the MTP device class helper function mtp_container_get_string() located in src/class/mtp/mtp.h. The root cause is an unchecked memcpy operation that copies up to 510 bytes into a fixed-size destination buffer when process...

EUVD-2026-116211

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtpcontainergetstring in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character coun...

openSUSE 16 Security Update : micropython (openSUSE-SU-2026:20199-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20199-1 advisory. Changes in micropython: - CVE-2026-1998: Fixed segmentation fault in mpmaplookup via mpimportall bsc1257803. - Version 1.26.1 esp32: update esptinyusb...

tinyusb:msc: Crash in getTypeCacheHashTableBucket

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=5128151041900544 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: msc Job Type: libfuzzerubsantinyusb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x55f4ab740694 Crash State:...

tinyusb:net: Null-dereference READ in ubsan_GetStackTrace

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=5011525650939904 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: net Job Type: libfuzzerubsantinyusb Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash...

tinyusb:msc: Crash in usbd.h

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=5678933151645696 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: msc Job Type: libfuzzerubsantinyusb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5a37c3410c00 Crash State:...

tinyusb:cdc: Global-buffer-overflow in dcd_event_handler

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=5245778781339648 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: cdc Job Type: libfuzzerasantinyusb Platform Id: linux Crash Type: Global-buffer-overflow READ 1 Crash Address: 0x5607db3bcaaf...

tinyusb:cdc: Crash in _cdcd_itf

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=5771505863819264 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: cdc Job Type: libfuzzerubsantinyusb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5ad4df02adb0 Crash State:...

tinyusb:msc: Crash in msc

Detailed Report: https://oss-fuzz.com/testcase?key=6065053163126784 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: msc Job Type: libfuzzerasantinyusb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000f2010100 Crash State: msc Sanitizer: address ASAN Recommended Security...

tinyusb:msc: Index-out-of-bounds in dcd_event_handler

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=6481187343499264 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: msc Job Type: libfuzzerubsantinyusb Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

tinyusb:msc: Crash in msc

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=5244269906690048 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: msc Job Type: libfuzzerasantinyusb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffff0e7f06ff91 Crash State:...

USBCoercer: A TinyUSB Based WPAD Coercion Device

USBCoercer turns an ESP32 development board with native USB-OTG into an Ethernet-over-USB gadget capable of coercing proxy configuration via WPAD. It builds on the TinyUSB Network Control Model NCM example and adds a minimalist DHCP server that injects DHCP option 252 WPAD/PAC and, additionally,...

tinyusb:msc: Crash in dcd_int_handler

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=6587755753963520 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: msc Job Type: libfuzzerasantinyusb Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7a2cd5de5e00 Crash State:...

tinyusb:cdc: Null-dereference READ in ubsan_GetStackTrace

Project: https://github.com/hathach/tinyusb.git Detailed Report: https://oss-fuzz.com/testcase?key=5958137187467264 Project: tinyusb Fuzzing Engine: libFuzzer Fuzz Target: cdc Job Type: libfuzzerubsantinyusb Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash...