EUVD-2026-116211
GHSA-cx2w-pw8j-8rvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect malicious USB host to MTP device
-
ExploitSend MTP string with unbounded character count
-
ExecutionOverflow fixed buffer via unchecked memcpy (up to 510 bytes)
-
ImpactCorrupt adjacent memory to crash or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target device must implement and expose the TinyUSB MTP device class (src/class/mtp/mtp.h); devices not using MTP are unaffected. Exploitation requires physical USB access - the attacker must control or substitute the USB host the device connects to in order to deliver a crafted MTP string with an unbounded character count. Limiting factors: physical connectivity is mandatory (AV:P), so remote/network exploitation is not possible; the device is affected only in TinyUSB versions through 0.21.0 prior to fix commit e85c2b8. No authentication or user interaction is needed once a malicious host is connected (PR:N/UI:N). |
| Impact | This is a genuine memory-corruption flaw (CWE-787 out-of-bounds write) but its real-world risk is bounded primarily by the attack vector. The supplied CVSS 4.0 vector (CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 7.0 High) rates technical impact as high across confidentiality, integrity and availability, which is consistent with the description's claim of code execution or denial of service. The decisive limiter is AV:P (Physical): exploitation requires a malicious USB host physically connected to the TinyUSB device, so this is not remotely exploitable over a network and does not scale like a network RCE. No EPSS score was provided, the CVE is not listed in CISA KEV, and no confirmed proof-of-concept exploit code is present in the input - only a vendor patch commit and a VulnCheck advisory reference. The vendor-priority decision label is 'this_week', indicating an elevated but non-emergency timeline. Net assessment: a real, patch-worthy issue for any device that exposes the MTP class, but the physical-access requirement makes it targeted rather than a widespread-exploitation priority; it should not be treated as an internet-facing critical. |
| Exploit ScenarioDerived | An attacker with physical access connects a TinyUSB-based device (or its USB port) to a malicious USB host that they control. The host enumerates the MTP device class and sends a crafted MTP string declaring an oversized, unbounded character count, causing mtp_container_get_string() to memcpy up to 510 bytes into a fixed-size destination buffer and corrupt adjacent memory, leading to a crash (DoS) or potential code execution. No confirmed public exploit code is present in the available data; low attack complexity (AC:L) and no authentication (PR:N) mean exploitation is straightforward once physical USB connectivity is established. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
An out-of-bounds write in TinyUSB's MTP device class helper mtp_container_get_string() (src/class/mtp/mtp.h) lets a malicious USB host corrupt adjacent memory on the device by supplying a crafted MTP string with an unchecked character count, with the resulting memory corruption potentially leading to code execution or a denial of service. Only firmware built through TinyUSB 0.21.0 that implements and exposes the MTP device class is affected, and because the attacker must control or substitute the USB host the device is attached to, exploitation requires physical USB access, though once that connection exists no authentication or user interaction is needed. The flaw is rated 7.0 (CVSS 4.0, full confidentiality/integrity/availability impact on the device), is fixed upstream by commit e85c2b8 with a vendor patch available, and is prioritized for remediation this week; no CISA KEV entry and no public exploit were identified at time of analysis.
RemediationAI
Apply the upstream fix in commit e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9 (https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9) or move to the first TinyUSB release that contains it; the data confirms a vendor-available patch via that commit but does not identify a tagged release version, so verify the tag containing the commit before pinning. If immediate upgrading is not possible, the most direct compensating control is to stop exposing the MTP device class: exclude src/class/mtp from the firmware build and do not register an MTP interface, accepting the loss of MTP functionality on that product. As a secondary measure, restrict physical access to the device's USB port (port blockers, sealed enclosures, or host-side allow-listing of known USB devices), which raises the cost of the AV:P attack path but does not fix the underlying unchecked copy. See the VulnCheck advisory (https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string) for the reporter's details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TinyUSB is an open-source, device-side USB stack for embedded microcontrollers, and its MTP (Media Transfer Protocol) device class implements the PTP/MTP container format in which strings are encoded as a length-prefixed character count followed by UTF-16 data. The reported defect is CWE-787 (out-of-bounds write): mtp_container_get_string() performs a memcpy of up to 510 bytes dictated by the character count carried in the attacker-supplied container, without validating that count against the size of the fixed-size destination buffer, so a host that advertises a larger string than the buffer can hold writes past the end of that buffer into adjacent memory. The vulnerability is only reachable in builds that include the MTP class (CPE cpe:2.3:a:hathach:tinyusb covers the affected library through 0.21.0); the CVSS 4.0 vector AV:P/AC:L/AT:N/PR:N/UI:N places the attack vector at the physical layer - the hostile party is the USB host the embedded device enumerates against, not a network peer. The commit referenced as the fix (e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9) is also accompanied in the supplied diff by build-selection and HIL test-harness changes (board MCU_VARIANT grouping, test/hil/mtp_raw.py registration), so the visible hunks describe tooling and test coverage around the driver rather than the mtp.h bounds check itself; the exact code change to the string-copy path is not shown in the available excerpt.
Know when Tinyusb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AV:P because exploitation needs a physically connected malicious USB host; AC:L and PR:N/UI:N since a crafted MTP string triggers it without auth; C/I/A:H from out-of-bounds write enabling code execution.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.
Executive ViewAI
TinyUSB 0.21.0-based firmware exposing the MTP device class contains a high-severity out-of-bounds write that lets a malicious USB host corrupt device memory, potentially enabling code execution or denial of service. Any product using this firmware and connected to an untrusted USB host is at risk, requiring physical access but no authentication. Leadership should prioritize patching this week to protect device integrity and availability, and to meet remediation timelines.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB