CVE-2026-61497

MEDIUM 5.2

TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser

CVSS Score

5.2

EPSS Score

0.0%

EPSS Percentile

0th

TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.

CWE	CWE-191
Vendor	hathach
Product	tinyusb
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for hathach tinyusb

Be the first to know when new medium vulnerabilities affecting hathach tinyusb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Affected Versions

hathach / TinyUSB

0 < 0.20.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/hathach/tinyusb/releases/tag/0.21.0 github.com: https://github.com/hathach/tinyusb/commit/85047e1777f5c20b7a936aa905c746125d3ed066 vulncheck.com: https://www.vulncheck.com/advisories/tinyusb-integer-underflow-via-hid-report-descriptor-parser

Credits

🔍 Shukhratbek Uraiimov