TinyUSB CVE-2026-61497

The host must be built with TinyUSB (before 0.20.1) acting as a USB HID host that parses device report descriptors via tuh_hid_parse_report_descriptor(). The attacker must have physical access to attach a USB device (CVSS AV:P) that presents a crafted, truncated HID report descriptor whose item size exceeds the remaining buffer, causing the uint16_t desc_len to underflow. Limiting factors: exploitation requires physical presence and a device that can emulate a malicious USB HID descriptor; it is not reachable over any network, needs no authentication (PR:N) and no user interaction beyond connecting the device (UI:N). Impact is confined to a host crash (DoS) and limited out-of-bounds reads, not code execution or integrity loss.

This is a genuinely medium/low real-world priority despite the integer-underflow mechanism, and the limiting signal is the attack vector. The CVSS 4.0 vector (base 5.2) specifies AV:P - physical access - meaning an attacker must physically connect a malicious USB device to a host running TinyUSB as a USB HID host; this is not remotely exploitable. AC:L/AT:N/PR:N/UI:N indicate that once physical access exists the trigger is reliable, needs no privileges, and no user interaction beyond plugging in the device. Impact is bounded: VA:H (denial of service via host crash) plus VC:L (limited out-of-bounds read disclosure), with no integrity impact (VI:N) and no scope change (SC/SI/SA:N). The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. This is NOT in CISA KEV and no confirmed exploit code is identified, so there is no evidence of active exploitation. Net: a legitimate bug worth patching on a normal cycle, but the physical-access requirement confines realistic risk to scenarios where untrusted USB devices reach the host (kiosks, unattended embedded/host devices, supply-chain or evil-maid situations) rather than broad remote compromise.

An attacker with physical access connects a crafted USB device presenting a truncated HID report descriptor to a host running TinyUSB as a USB HID host. When tuh_hid_parse_report_descriptor() subtracts an item size from the remaining descriptor length without verifying the item fits, the uint16_t desc_len underflows, causing out-of-bounds memory reads that crash the host (denial of service). No public exploit code is identified at time of analysis; exploitation requires physical USB access per CVSS AV:P.