Threats affecting pkg:github/hathach/tinyusb

TinyUSB versions before 0.20.1 have an integer underflow vulnerability in the HID host report descriptor parser function tuh_hid_parse_report_descriptor(). This flaw allows a malicious USB device with a crafted truncated report descriptor to cause an underflow in the descriptor length calculation, leading to out-of-bounds memory reads and denial of service on the host system.