UNKNOWN READ Vulnerability in TinyUSB Package
Summary
OSV-2026-215: UNKNOWN READ in getTypeCacheHashTableBucket. Affects tinyusb versions >= b73df6c22e4743f9232f7922fe2cf0fbd05a3a2e, < 9a577ac752cf627724066e59b3e1fe007c1d8268. Fixed in 9a577ac752cf627724066e59b3e1fe007c1d8268. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyUSB is an open-source USB Host/Device stack designed for embedded systems, providing a lightweight and efficient way to implement USB communication. It is widely used in various applications due to its simplicity and ease of integration. However, like any software, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as UNKNOWN READ in the function getTypeCacheHashTableBucket can lead to unexpected behavior or crashes within applications utilizing the TinyUSB package. This issue was reported through OSS-Fuzz, indicating that it may allow unauthorized access to memory, potentially leading to data corruption or application crashes. The vulnerability was introduced in commit b73df6c22e4743f9232f7922fe2cf0fbd05a3a2e and was subsequently fixed in commit 9a577ac752cf627724066e59b3e1fe007c1d8268.
How To Fix
Minimum fixed version
9a577ac752cf627724066e59b3e1fe007c1d8268
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using the affected function getTypeCacheHashTableBucket until the package is updated. This may involve modifying your code to bypass calls to this function or using alternative methods for USB communication.
Conclusion
The UNKNOWN READ vulnerability in the TinyUSB package poses a significant risk to applications relying on this library. It is crucial to update to the patched version to mitigate potential issues. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for tinyusb →
FAQ
The impact includes potential crashes and unauthorized memory access, which can lead to data corruption.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Consider implementing workarounds such as avoiding the use of the affected function until an update can be applied.
You can visit the TinyUSB GitHub repository for documentation and updates on the package.
Yes, the vulnerability was introduced in a specific commit and has been fixed in a later commit. Ensure you are using the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tinyusb.
