---
id: CVE-2026-61495
title: TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()
summary: >-
  TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds
  write vulnerability in the MTP device class helper mtp_container_get_string()
  in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent
  memory b…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: hathach
product: TinyUSB
affected:
  - TinyUSB <= 0.21.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T22:36:40.400955Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:39:43.266Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61495'
references:
  - url: >-
      https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string
    label: >-
      VulnCheck Advisory: TinyUSB 0.21.0 Out-of-Bounds Write via
      mtp_container_get_string()
tags:
  - cve.org
epss: 0.00266
epssPercentile: 0.1859
ingestedAt: '2026-11-05T20:33:06.601Z'
---

## Overview

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.

## Affected

- `TinyUSB <= 0.21.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.