Threats tagged 'ghsa-cx2w-pw8j-8rvm'

TinyUSB versions through 0.21.0 contain an out-of-bounds write vulnerability in the MTP device class helper function mtp_container_get_string(). This flaw allows a malicious USB host to supply a crafted MTP string with an unbounded character count, leading to memory corruption. The vulnerability arises from an unchecked memcpy operation that copies up to 510 bytes into a fixed-size buffer. Exploitation can result in code execution or denial of service on the affected device. The issue was fixed in commit e85c2b8.