CVE-2026-96582Medium· 4.9▾ SunlitA HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it.
The walk checked that an item fitted in the descriptor only after it had advanced past the header and parsed the payload, and the item analysis it relied on never measured the declared sizes against the bytes actually received. A HID peripheral returning a short report descriptor therefore drove a heap out-of-bounds read during ordinary enumeration.
USBX <= 6.5.1.202602Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96402Medium· 5.2USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
CVE-2026-96406Medium· 4.9VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
CVE-2026-95111Medium· 4.8Module queue front-send validates a word count as a byte count
CVE-2026-91186High· 8.4PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
CVE-2026-92446Medium· 6.8GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
CVE-2026-91059Medium· 6.8JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size