Skip to main content
View

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

This is a genuine but low-priority issue whose real-world risk is materially lower than a raw scan of 'out-of-bounds write / CWE-787' would suggest. Red Hat's own CVSS 3.1 vector (4.1, AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) constrains impact to availability only - no confidentiality or integrity loss is scored, meaning Red Hat treats this as a memory-corruption crash/DoS of the host process rather than a demonstrated code-execution primitive, despite the OOB-write nature of the flaw. Exploitation prerequisites are demanding on paper: local vector, high attack complexity, and high privileges. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or automatable exploitation. The one signal worth challenging is AV:L: usbredir is the USB-redirection library embedded in QEMU/SPICE, and the malicious 'usbredir peer' can be a SPICE client whose traffic traverses the network - so AV:N is defensible and defenders in remote-USB-redirection deployments should not over-rely on the 'local' label. AC:H is also arguably too high given the trigger is trivially simple (start an isochronous OUT stream with transfer count of 1). Net: a real bug worth patching in the normal cycle, not an emergency.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 21, 2026

Isochronous OUT stream handling in usbredir can leave a stream's single transfer buffer permanently unsubmitted when a transfer count of 1 is used, which defeats the bounds check in usbredirhost_iso_packet() and lets a usbredir peer write beyond the end of the packet descriptor array on every subsequent isochronous packet. The flaw is an out-of-bounds write (CWE-787) affecting usbredir as shipped in Red Hat Enterprise Linux 6 through 10, and the published CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.1) reflects a local, high-complexity, privileged trigger path whose dominant impact is availability loss rather than code execution. No public exploit identified at time of analysis, and the bug is not listed as confirmed actively exploited (CISA KEV); the realistic risk is materially lower than the raw memory-corruption classification suggests.

RemediationAI

No vendor-released patch identified at time of analysis for CVE-2026-92382; monitor https://access.redhat.com/security/cve/CVE-2026-92382 and https://bugzilla.redhat.com/show_bug.cgi?id=2535972 for the Red Hat errata addressing the affected RHEL 6 through 10 packages, and apply the fixed usbredir build as soon as it is published rather than assuming the low CVSS score makes the issue ignorable. Until then, the practical control is to remove the trigger path: do not permit untrusted or unauthenticated parties to act as a usbredir/SPICE USB-redirection peer, and restrict the redirection endpoint to trusted clients over an authenticated, encrypted transport, since the flaw is only exercised by a peer that can start isochronous OUT streams. Where isochronous USB device passthrough is not required, disable USB redirection for the affected guests entirely - this eliminates exposure but breaks hot-plug and passthrough of isochronous devices such as audio and video peripherals. Restricting local access to the virtualization service and its sockets (rather than relying on the guest-side peer as a trust boundary) reduces the likelihood of the privileged local trigger the CVSS vector describes, at the cost of limiting legitimate administrative workflows; because the vector calls for high privileges and high complexity, these access restrictions are proportionate compensating controls rather than emergency measures, and they should be lifted once the patched package is available.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

usbredir is the USB device redirection protocol and host-side library used by virtualization stacks (notably SPICE) to forward locally attached USB devices to a guest over a network connection; usbredirhost is the component that parses incoming protocol packets and drives libusb transfers on the host side. Isochronous transfers are modelled as a stream with a single transfer buffer submitted repeatedly, and packet descriptors for each isochronous packet are indexed against that buffer. The reported defect is an edge case in stream setup: starting an isochronous OUT stream with a transfer count of 1 leaves the buffer permanently unsubmitted, so the guard in usbredirhost_iso_packet() no longer reflects actual buffer state and each subsequent isochronous packet indexes past the end of the packet descriptor array. Per the provided CWE mapping this is CWE-787 (out-of-bounds write), a memory-safety class in which attacker-influenced packet data can corrupt adjacent heap structures; here the access vector in the CVSS vector is local (AV:L) with high attack complexity (AC:H) and high privileges required (PR:H), so the misbehaving 'peer' is best understood in the context of an already-privileged, already-local caller rather than a remotely reachable, unauthenticated attacker.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
SUSE 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 4.1 MEDIUM

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Threat Intelligence Overview

EPSS Score
0.1%
Top 97% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

20
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +20
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-107935 CRITICAL
9.3 Oct 09

Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-92382 REF https://access.redhat.com/security/cve/CVE-2026-92382 REF https://bugzilla.redhat.com/show_bug.cgi?id=2535972

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy