CVE-2026-61497

The record

TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.

Affected packages

Related vulnerabilities

• CVE-2026-121727 Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body… CWE-191
• CVE-2026-120060 psqlODBC trusts counts and lengths in server data in three places. CWE-191
• CVE-2026-120058 psqlODBC sizes its row cache from the column count of a cursor's first result, but… CWE-191
• CVE-2026-20576 In afe, there is a possible out of bounds write due to a missing bounds check. CWE-191
• CVE-2026-20572 In adsp, there is a possible out of bounds write due to an integer overflow. CWE-191
• CVE-2026-111735 P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). CWE-191
• CVE-2026-103411 An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session… CWE-191
• CVE-2026-112625 An integer underflow was addressed with improved input validation. CWE-191