Critical UNKNOWN READ Vulnerability in TinyUSB Package
Summary
OSV-2025-767: UNKNOWN READ in dcd_int_handler. Affects tinyusb versions >= 0263cfc01ab63d6799e80cbbf691af1979cf3ab7, < 20c36442246279d884a6b61066fda6778c1c06ee. Fixed in 20c36442246279d884a6b61066fda6778c1c06ee. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyUSB is an open-source USB Host/Device stack designed for embedded systems. It provides a lightweight and efficient way to implement USB communication in microcontrollers, enabling developers to easily integrate USB functionality into their projects. However, like many software libraries, TinyUSB is susceptible to vulnerabilities that can compromise the integrity and security of applications utilizing it.
Vulnerability Detail
The vulnerability identified as UNKNOWN READ in the dcd_int_handler function of TinyUSB was reported through OSS-Fuzz. This issue arises from improper handling of memory reads, which can lead to crashes or unexpected behavior in applications using the library. The crash state indicates that the vulnerability can be exploited under certain conditions, potentially allowing an attacker to disrupt the normal operation of the software or gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
20c36442246279d884a6b61066fda6778c1c06ee
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as possible to mitigate any risks associated with the UNKNOWN READ issue.
Conclusion
The UNKNOWN READ vulnerability in the TinyUSB package poses a significant risk to applications utilizing this library. It is crucial for developers to update to the patched version to mitigate potential security threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for tinyusb →
FAQ
The UNKNOWN READ vulnerability involves improper memory handling in the dcd_int_handler function, which can lead to application crashes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Yes, a patch is available in the fixed version of TinyUSB, which can be obtained from the commit 20c36442246279d884a6b61066fda6778c1c06ee.
Failing to address this vulnerability may lead to application crashes or unauthorized access to sensitive data, compromising the security of the system.
You can use tools like Vulert to receive real-time alerts for open-source vulnerabilities in your software, ensuring you are always informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinyusb.
