CVE-2026-96406: VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the configuration descriptor actually received.
A device that reports a wTotalLength larger than the descriptors it supplies therefore had its own claim believed. Once the real bytes ran out the walk kept going, dereferencing the cursor past the end of the configuration buffer, in the host's context, whenever the application queried format or frame data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
USBX hosts that parse VideoStreaming USB interface descriptors are exposed when an application queries format or frame data from a connected device. Exploitation requires a malicious or malformed USB video device that advertises a descriptor-block length larger than the configuration data it actually supplies.
Does exploitation require credentials or user interaction?
No privileges are required. The supplied vector indicates physical access and user interaction; the vulnerable walk occurs when the application queries format or frame data for the device.
What is the impact of a successful exploit?
The host can dereference a cursor beyond the end of its received configuration buffer. The provided severity vector indicates low confidentiality impact, no integrity impact, and high availability impact.