CVE-2026-116776: USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS
USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISKGEOMETRY.BytesPerSector returned by IOCTLDISKGETDRIVEGEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), §or, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
USB Testto a version that resolves this vulnerability.Fixed in 1.1.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running USB Test versions before 1.1.5 are exposed when they start a drive test against a physically connected malicious USB storage device. The impact is greater if the application is running elevated, because heap corruption can crash the elevated process and may allow arbitrary code execution.
What does an attacker need to exploit it?
An attacker needs to provide a malicious USB storage device that reports crafted geometry data. A reported sector size of zero can trigger a divide-by-zero denial of service, while a value below eight bytes can cause repeated out-of-bounds heap writes.
Is there a mitigation if updating is not immediately possible?
Do not run drive tests on untrusted or unknown USB storage devices until USB Test can be updated. The issue is fixed in version 1.1.5.