Threats tagged 'ghsa-qf63-w79j-qw7p'

TinyUSB versions before 0.20.1 have an integer underflow vulnerability in the HID host report descriptor parser function tuh_hid_parse_report_descriptor(). This flaw allows a malicious USB device with a crafted truncated report descriptor to cause an underflow in the descriptor length calculation, leading to out-of-bounds memory reads and denial of service on the host system.