{"id":"CVE-2026-116776","title":"USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS","summary":"USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSect…","severity":"high","cvss":7,"cvssVector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","cvssSource":"cna","cwe":["CWE-122"],"vendor":"n-romanovich","product":"usb-test","affected":["usb-test < 1.1.5"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T18:36:46.958376Z"},"exploitAvailable":true,"published":"2026-10-28","updated":"2026-10-29","sourceUpdated":"2026-10-29T18:37:18.070Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116776","references":[{"url":"https://github.com/n-romanovich/usb-test/security/advisories/GHSA-cfrv-c9q2-7cr3","label":"https://github.com/n-romanovich/usb-test/security/advisories/GHSA-cfrv-c9q2-7cr3"},{"url":"https://github.com/n-romanovich/usb-test/commit/5b6caac844461024520b02337d3a541fbe128f89","label":"https://github.com/n-romanovich/usb-test/commit/5b6caac844461024520b02337d3a541fbe128f89"},{"url":"https://github.com/n-romanovich/usb-test/releases/tag/release-v1.1.5","label":"https://github.com/n-romanovich/usb-test/releases/tag/release-v1.1.5"}],"tags":["cve.org","exploit-available"],"epss":0.00177,"epssPercentile":0.07342,"ingestedAt":"2026-10-28T16:13:50.582Z","slug":"CVE-2026-116776","body":"## Overview\n\nUSB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), &sector, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.\n\n## Affected\n\n- `usb-test < 1.1.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":232001,"id":"CVE-2026-116776","ts":1793574268454,"field":"exploit_available","old":"false","new":"true"}]}