CVE-2026-61495 in TinyUSB
Summary
by MITRE • 11/03/2026
TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in TinyUSB versions through 0.21.0 represents a critical security flaw within the Media Transfer Protocol (MTP) device class implementation, specifically located in the helper function mtp_container_get_string found in src/class/mtp/mtp.h. This out-of-bounds write issue arises from an unchecked memcpy operation that fails to validate the length of incoming string data against the capacity of the destination buffer. When a malicious USB host supplies a crafted MTP request containing an unbounded or excessively large character count, the function proceeds to copy up to 510 bytes into a fixed-size stack or heap buffer without performing necessary boundary checks. This lack of input validation allows data to spill over the allocated memory region, corrupting adjacent memory structures and potentially leading to severe system instability or compromise.
From a technical perspective, this flaw is classified under CWE-787: Out-of-bounds Write, which describes situations where software writes data past the end, or before the beginning, of the intended buffer. The root cause lies in the absence of rigorous bounds checking prior to memory copy operations within the MTP string retrieval logic. By exploiting this weakness, an attacker can overwrite critical control data such as return addresses, function pointers, or other sensitive variables stored in adjacent memory locations. This capability transforms a simple input validation error into a potent vector for arbitrary code execution, allowing remote attackers to gain elevated privileges on the target device running TinyUSB.
The operational impact of this vulnerability is significant, particularly in environments where embedded devices expose MTP interfaces to untrusted or potentially hostile USB hosts. Successful exploitation can result in complete denial of service due to memory corruption causing crashes or system reboots. More critically, it enables remote code execution with the privileges of the compromised process. This poses a severe risk to IoT devices, media players, and other embedded systems that rely on TinyUSB for file transfer functionalities, as attackers could install malware, exfiltrate sensitive data, or use the device as a pivot point for further network attacks.
To mitigate this vulnerability, organizations must immediately update their TinyUSB libraries to version 0.21.1 or later, where commit e85c2b8 addresses the issue by implementing proper length validation before executing memory copy operations. In addition to software updates, developers should enforce strict input sanitization for all USB descriptors and MTP requests processed by embedded devices. Adopting secure coding practices that prioritize bounds checking in C-based firmware development is essential. Furthermore, deploying network segmentation or physical access controls can limit exposure to untrusted hosts until patches are fully deployed across the infrastructure.
This vulnerability aligns with MITRE ATT&CK technique T1203: Exploitation for Client Execution, where attackers leverage vulnerabilities in client applications or services to execute malicious code on a target system. It also reflects common pitfalls described in CWE-20: Improper Input Validation, emphasizing the necessity of validating all external inputs against expected constraints before processing. Ensuring that firmware components like TinyUSB are kept up-to-date and configured with minimal privileges reduces the attack surface available for such exploitation attempts.