hathach TinyUSB up to 0.20.0 HID host report descriptor parser src/class/hid/hid_host.c tuh_hid_parse_report_descriptor integer underflow

Summaryinfo

A vulnerability was found in hathach TinyUSB up to 0.20.0. It has been classified as problematic. Affected by this vulnerability is the function tuh_hid_parse_report_descriptor of the file src/class/hid/hid_host.c of the component HID host report descriptor parser. Performing a manipulation results in integer underflow. This vulnerability is reported as CVE-2026-61497. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in hathach TinyUSB up to 0.20.0. This affects the function tuh_hid_parse_report_descriptor of the file src/class/hid/hid_host.c of the component HID host report descriptor parser. The manipulation with an unknown input leads to a integer underflow vulnerability. CWE is classifying the issue as CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-61497 since 07/10/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 0.20.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• hathach

Name

• TinyUSB

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20.0

Website

• Product: https://github.com/hathach/tinyusb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion