Heap Out-of-Bounds Read in USBX Host Affects HID Devices

CVE-2026-96582

What is CVE-2026-96582?

The USBX host is susceptible to a vulnerability during the enumeration process of Human Interface Devices (HID). When a HID peripheral returns a short report descriptor, the USBX host mismanages the parsing sequence. Specifically, it advances past the header without adequately verifying that the declared sizes of the descriptor match the actual data received. This oversight can result in a heap out-of-bounds read, potentially exposing the system to various security risks. Mitigation involves updating to the latest version of USBX, where the management of HID report descriptors has been enhanced to ensure proper size validation during enumeration.

References