CVE-2026-96582Medium· 4.9▾ SunlitA HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it.
The walk checked that an item fitted in the descriptor only after it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.
USBX <= 6.5.1.202602Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96402Medium· 5.2USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
CVE-2026-96406Medium· 4.9VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
CVE-2026-111075High· 8.7JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
CVE-2026-110938High· 8.7JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
CVE-2026-91057Medium· 4.6Out-of-bounds read when a multi-line text view string ends with a carriage return
CVE-2026-92853High· 8.7Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure