CVE-2026-92382: Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write
An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A usbredir peer can exploit it by sending subsequent isochronous packets after an isochronous OUT stream is started with a transfer count of 1. The CVSS vector indicates local access, high attack complexity, and high privileges are required.
What is the impact of successful exploitation?
Successful exploitation allows heap out-of-bounds writes past the packet descriptor array. The reported impact is availability loss; confidentiality and integrity impacts are listed as none.
Is a transfer count of 1 significant for exposure?
Yes. The flaw is triggered when an isochronous OUT stream is started with a transfer count of 1, which leaves its single transfer buffer permanently unsubmitted and defeats the bounds check for later packets.