TinyUSB vulnerabilities
CVEs whose affected-version data names the TinyUSB package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-61495Medium· 6.8TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()
TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory b…
▾ Sunlithathach · TinyUSBEPSS 0.27%via CVEORG
CVE-2026-61497Medium· 5.2TinyUSB < 0.20.1 Integer Underflow via HID Report Descriptor Parser
TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report descriptor parser tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that allows a malicious USB device to trigger an out-of-bounds read …
▾ Sunlithathach · TinyUSBEPSS 0.28%via CVEORG