Executive brief
usbredir is a library that enables USB device redirection over networks, commonly used in virtualized and remote desktop environments. A flaw in how it handles isochronous USB streams with a transfer count of 1 allows an attacker to write beyond the bounds of allocated memory, potentially causing the system to crash or become unavailable. The vulnerability requires local access and elevated privileges to exploit.
Technical details
An out-of-bounds write flaw exists in usbredir's usbredirhost_iso_packet() function when an isochronous OUT stream is started with a transfer count of 1. The stream's single transfer buffer remains unsubmitted, defeating the bounds check and allowing subsequent isochronous packets to write past the end of the packet descriptor array. Attack vector is local with high attack complexity and high privilege requirement; the impact is availability (denial of service via crash).
Affected products
- usbredir
Timeline
- 2026-09-21: disclosed