CVE-2026-96582

Name of the Vulnerable Software and Affected Versions USBX (affected versions not specified)

Description A heap out-of-bounds read occurs during ordinary enumeration when a HID peripheral returns a short report descriptor. The USBX host processes the report descriptor sequence by advancing over headers and parsing payloads, but it only verifies if an item fits in the descriptor after the header has been processed and the payload parsed. Furthermore, the analysis does not validate the declared sizes against the actual bytes received.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.