CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

CVE-2026-96406

The USBX host is vulnerable to an out-of-bounds read (CWE-125) during the processing of a VideoStreaming interface . The host incorrectly uses the device-controlled wTotalLength field from the input header as a budget for walking format, frame, and frame-interval descriptors without validating it...

CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

SUSE CVE-2026-23679

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength...