USB Test CVE-2026-116776

Requires a physically connected USB storage device with malicious or altered firmware that returns a crafted DISK_GEOMETRY.BytesPerSector - specifically a value below 8 (e.g., 1) to trigger the 7-byte heap out-of-bounds write at drivetest.cpp:86, or 0 to trigger the divide-by-zero at drivetest.cpp:61, or an enormous value (e.g., 2000000000) to cause std::bad_alloc. The victim must run the elevated USB Test application (<= 1.1.4), select the rogue drive, and start a drive test; getSectorSize() in driveinfo.cpp must not have the v1.1.5 success/bounds validation. Limiting factors: no network or remote vector, physical device access and active user initiation of a test are both required, and the issue is absent once updated to 1.1.5 (the vendor states updating is the fix; the only workaround is to avoid testing untrusted devices and secure the system against unauthorized driver modification).

The signals point to a genuine but tightly-scoped memory-safety flaw rather than a widespread emergency. The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:H/UI:P) is the dominant limiter: exploitation requires a physically connected malicious USB storage device (AV:P), an elevated/privileged context (PR:H), and user interaction to start a drive test (UI:P), which together make opportunistic or automated mass exploitation implausible. No EPSS score is provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. The advisory supplies a proof-of-concept, but it is an in-source simulation (hard-coding BytesPerSector) rather than a verified working device-firmware exploit, so RCE remains 'a credible threat' per the vendor, with only DoS and predictable heap corruption actually proven. The vuln.today decision label is 'this_week', consistent with a patch-promptly-but-not-emergency posture. Net: this is a real, well-documented RCE/DoS primitive for the handful of people who run this niche tool, but the physical attack vector, required privileged context, and tiny deployment footprint keep real-world risk low for the general population despite the 7.0 base score.

An attacker hands or plants a USB flash drive with malicious/altered firmware that reports a sector size below eight bytes (e.g., 1) or zero. A victim connects it and runs the elevated USB Test utility, selects the rogue drive, and starts any test; the undersized buffer is overflowed by the fixed 8-byte memcpy (or a divide-by-zero fires), crashing the elevated process and potentially allowing code execution. A public proof-of-concept exists as an in-source simulation; it is not verified as working, device-delivered exploit code.