CVE-2026-17050

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

EUVD-2026-84012

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

CVE-2026-17050

The Zephyr RTOS experimental USB host stack is vulnerable to a double free in the usb_device_heap when handling a malformed or malicious USB peripheral. Specifically, in usbh_device_set_configuration(), a buffer (udev->cfg_desc) is released via k_heap_free() on three specific failure paths, bu...

CVE-2026-17050 Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

CVE-2026-17050 Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

PT-2026-96155

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.1.0 through 4.4.x Description The experimental USB host stack contains a double free issue in the usb device heap. In the usbh device set configuration function within subsys/usb/host/usbh device.c, a configuration-descriptor...

CVE-2026-17050: Double Free

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

JLSEC-2026-1358 Wasmtime has host data leakage with 64-bit tables and Winch

Impact Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive...

CVE-2026-10663

In Zephyr's experimental USB host stack CONFIGUSBHOSTSTACK, usbhdevicedisconnect subsys/usb/host/usbhdevice.c freed the root usbdevice slab object without clearing the cached pointer ctx-root. The bus removal handler devremovedhandler subsys/usb/host/usbhcore.c decides what to tear down solely fr...

CVE-2026-10663

The vulnerability CVE-2026-10663 affects Zephyr’s experimental USB host stack (CONFIG_USB_HOST_STACK). freed root usb_device slab in usbh_device_disconnect() leaves ctx->root dangling; bus removal handler dev_removed_handler() uses ctx->root to decide teardown. Synthesis of DEV_REMOVED even...

CVE-2026-10663 Use-after-free / double-free of the root USB device in the experimental USB host stack

In Zephyr's experimental USB host stack CONFIGUSBHOSTSTACK, usbhdevicedisconnect subsys/usb/host/usbhdevice.c freed the root usbdevice slab object without clearing the cached pointer ctx-root. The bus removal handler devremovedhandler subsys/usb/host/usbhcore.c decides what to tear down solely fr...

SUSE CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...

CVE-2026-34945

A flaw was found in Wasmtime's Winch compiler. This vulnerability, present in versions from 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, arises from an incorrect translation of the table.size instruction for 64-bit WebAssembly tables. An attacker, by crafting a malicious WebAssembly guest, could...

EUVD-2026-21024

Wasmtime has host data leakage with 64-bit tables and Winch...

GHSA-M9W2-8782-2946 Wasmtime has host data leakage with 64-bit tables and Winch

Impact Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the host's stack to WebAssembly guests. The host's stack can possibly contain sensitive...

DEBIAN-CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...

CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...

CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...

UBUNTU-CVE-2026-34945

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...

CVE-2026-34945 Wasmtime leaks host data with 64-bit tables and Winch

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size instruction. This bug could lead to disclosing data on the...