Read the docs
TI-2026-84565 Aliases CVE-2026-61497GHSA-qf63-w79j-qw7p

Integer underflow in TinyUSB HID report descriptor parser

Priority LOW 23CWE-191Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

TinyUSB before 0.20.1 contains an integer underflow in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c. The parser subtracts an item size from the remaining descriptor length without checking that the item fits in the buffer (CWE-191). A malicious USB device with a truncated report descriptor can make the length wrap, causing out-of-bounds memory reads and denial of service on the host.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed TinyUSB (hathach): 0.20.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hathachTinyUSBbefore 0.20.10.20.1Patch availableCNA
  • TinyUSB Vendorhathach Affected before 0.20.1 Fixed in 0.20.1 Patch available CNA

Remediation

Update TinyUSB to version 0.20.1 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA TinyUSB (hathach) Fixed in 0.20.1

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-61497
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Alias added: GHSA-qf63-w79j-qw7p

References

Patch 2

  • TI-2026-84558 Out-of-bounds write in TinyUSB MTP helper enables memory corruption CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences