CVE-2026-92382

Summary

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-787: Out-of-bounds Write

Workarounds

If USB redirection is not a required feature, consider removing the usbredir package. This action will eliminate the attack surface but may affect functionality that relies on USB device redirection, particularly in virtualized environments.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References