Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-61495TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()

Medium 6.8

In plain English

A medium-severity out-of-bounds write in TinyUSB from hathach. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 81.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	tinyusb	no fix listed	DEBIAN-CVE-2026-61495
Debian:14	tinyusb	no fix listed	DEBIAN-CVE-2026-61495
Ubuntu:26.04:LTS	tinyusb	no fix listed	UBUNTU-CVE-2026-61495
Ubuntu:26.10	tinyusb	no fix listed	UBUNTU-CVE-2026-61495

Affected products (as reported)

Vendor	Product	Versions
hathach	TinyUSB	0 – through 0.21.0

Weakness: CWE-787 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Patch Commit issue-tracking, patch
VulnCheck Advisory: TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string() third-party-advisory