Threats affecting pkg:github/n-romanovich/usb-test

A heap-based buffer overflow vulnerability exists in n-romanovich usb-test versions prior to 1.1.5. The vulnerability arises because the utility trusts the BytesPerSector value returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without verifying the call's success or validating the size. A malicious USB device can report a sector size below eight bytes, leading to out-of-bounds writes or a divide-by-zero crash during a drive test. This can cause heap corruption, crashing the elevated application and potentially allowing arbitrary code execution. The issue is fixed in version 1.1.5.