Hi,

The following vulnerabilities were published for tinyusb.

CVE-2026-61495[0]:
| TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-
| bounds write vulnerability in the MTP device class helper
| mtp_container_get_string() in src/class/mtp/mtp.h that allows a
| malicious USB host to corrupt adjacent memory by supplying a crafted
| MTP string with an unbounded character count. Attackers can exploit
| the unchecked memcpy operation copying up to 510 bytes into a fixed-
| size destination buffer to achieve code execution or cause a denial
| of service on the TinyUSB MTP device.

Fixed by: https://github.com/hathach/tinyusb/commit/e85c2b8affa1efbf00d398d59e7a87d3e61cc4a9

CVE-2026-61497[1]:
| TinyUSB before 0.20.1 contains an integer underflow vulnerability in
| the HID host report descriptor parser
| tuh_hid_parse_report_descriptor() in src/class/hid/hid_host.c that
| allows a malicious USB device to trigger an out-of-bounds read by
| subtracting an item size from the remaining descriptor length
| without validating the item fits within the remaining buffer.
| Attackers can present a crafted USB device with a truncated report
| descriptor causing the uint16_t desc_len value to underflow,
| resulting in out-of-bounds memory reads and denial of service on the
| host system.

Fixed by: https://github.com/hathach/tinyusb/commit/85047e1777f5c20b7a936aa905c746125d3ed066 (0.21.0)


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-61495
https://www.cve.org/CVERecord?id=CVE-2026-61495
[1] https://security-tracker.debian.org/tracker/CVE-2026-61497
https://www.cve.org/CVERecord?id=CVE-2026-61497

Please adjust the affected versions in the BTS as needed.