CVE-2026-61497Medium· 5.2▾ SunlitTinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read by subtracting an item size from the remaining descriptor length without validating the item fits within the remaining buffer. Attackers can present a crafted USB device with a truncated report descriptor causing the uint16_t desc_len value to underflow, resulting in out-of-bounds memory reads and denial of service on the host system.
TinyUSB < 0.20.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61495Medium· 6.8TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()
CVE-2025-66217High· 7.5AIS-catcher is a multi-platform AIS receiver
CVE-2019-12678High· 7.5A vulnerability in the Session Initiation Protocol (SIP) inspection module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a d…
CVE-2025-67269High· 7.5An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`
CVE-2026-123571High· 7.5Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decoding
CVE-2026-80303NoneAvast WFP stream parser integer underflow causes system crash