CVE-2026-92382 describes an out-of-bounds write flaw in usbredir. When an isochronous OUT stream is started with a transfer count of 1, the single transfer buffer is left permanently unsubmitted. This defeats the bounds check in the usbredirhost_iso_packet() function, enabling a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet. This vulnerability affects multiple specific versions of usbredir as enumerated in the affectedVersions field. The CVSS 3.1 vector indicates local attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The vulnerability allows a local attacker with high privileges to cause out-of-bounds writes in usbredir, potentially leading to denial of service or instability due to memory corruption. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, avoid starting isochronous OUT streams with a transfer count of 1 or restrict access to usbredir to trusted users with appropriate privileges.