USBX vulnerabilities
CVEs whose affected-version data names the USBX package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-96402Medium· 5.2USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count
A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.
CVE-2026-96582Medium· 4.9Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fit…
CVE-2026-96406Medium· 4.9VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and fram…