Heap Buffer Overflow in USB Test Utility for Windows by N. Romanovich

CVE-2026-116776

What is CVE-2026-116776?

The USB Test utility, designed for verifying sector integrity and detecting misleading capacity reporting on USB flash drives, contains a vulnerability that affects versions prior to 1.1.5. Specifically, the getSectorSize() function does not properly validate the BytesPerSector value returned by IOCTL_DISK_GET_DRIVE_GEOMETRY. This oversight can lead to situations where the report is smaller than expected, resulting in potential out-of-bounds writes during heap buffer allocation and manipulation. Such exploitation could enable attackers to crash the application or execute arbitrary code. This vulnerability has been resolved in version 1.1.5.

References