CVE-2026-116776 in usb-test
Summary
by MITRE • 10/28/2026
USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), §or, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in USB Test prior to version 1.1.5 stems from improper input validation of system-level hardware queries, specifically within the getSectorSize function located in driveinfo.cpp. The application relies on the IOCTL_DISK_GET_DRIVE_GEOMETRY control code to retrieve disk geometry information from connected storage devices. A critical flaw exists in that the software trusts the BytesPerSector field returned by this operating system interface without verifying whether the call succeeded or validating the magnitude of the returned value against expected constraints for standard USB flash drives. This lack of defensive programming allows a physically present attacker with access to a removable media device to manipulate the sector size parameter reported to the application, leading to severe memory safety violations and service disruption when the user initiates a drive integrity test.
From a technical perspective, the exploitation vector involves two distinct failure modes resulting from the unvalidated BytesPerSector value. First, if an attacker configures their malicious USB device to report a sector size below eight bytes, the subsequent logic in drivetest.cpp utilizes this value for division operations and heap buffer sizing calculations. When the application attempts to copy data using memcpy(buffer.data(), §or, 8), it writes eight bytes into a buffer that was allocated based on the smaller, manipulated sector size. This results in repeated out-of-bounds heap writes, corrupting adjacent memory structures such as allocation headers or function pointers. Second, if the malicious device reports a sector size of zero, the application performs a division by zero operation during its integrity verification calculations. This triggers an immediate exception within the elevated process, causing the application to crash and resulting in a denial of service for any ongoing disk testing operations.
The operational impact of this vulnerability is significant due to the context in which USB Test typically operates. As a utility designed to verify sector integrity and detect overreported capacity on removable media, it often requires administrative privileges or runs with elevated user rights to access low-level hardware interfaces. Consequently, heap corruption resulting from out-of-bounds writes can lead to arbitrary code execution if an attacker can control the contents of the corrupted memory regions. This allows for potential privilege escalation or remote code execution equivalents in scenarios where such tools are integrated into automated security workflows. The divide-by-zero flaw primarily impacts availability by crashing the elevated application, which disrupts legitimate administrative tasks and system monitoring activities dependent on this utility.
This vulnerability aligns with CWE-20 Improper Input Validation, as the software fails to verify that inputs received from an external source meet specified criteria before processing them. Additionally, it relates to CWE-190 Integer Overflow or Wraparound in the context of buffer sizing calculations and CWE-369 Divide By Zero for the denial-of-service condition. In terms of attack tactics, this scenario maps to ATT&CK technique T1204 User Execution, where a user is tricked into running malicious code by connecting a compromised USB device that exploits trust relationships within trusted applications. The exploitation relies on physical access and social engineering or opportunistic insertion of the malicious drive while the tool is active.
Mitigation for this vulnerability involves upgrading to version 1.1.5 or later, where the developers have implemented proper validation checks for the sector size returned by IOCTL_DISK_GET_DRIVE_GEOMETRY. Security best practices dictate that applications interacting with hardware interfaces must always validate return codes from system calls and enforce strict bounds on numeric values derived from external sources. Developers should implement explicit checks to ensure BytesPerSector is within a reasonable range, such as between 512 and 4096 bytes for most modern storage devices, before using the value in arithmetic operations or memory allocation functions. Furthermore, employing static analysis tools and fuzzing techniques during development can help identify similar input validation flaws in other components of the application that interact with system APIs without adequate sanitization.