CVE catalog

CVE-2026-92382

usbredir: CVE-2026-92382

[CVE catalog]

Severity
Medium · CVSS 4.1CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianusbredirsid0.15.0-1vulnerable
Debianusbredirforky0.15.0-1vulnerable
Debianusbredirtrixie0.15.0-1vulnerable
Debianusbredirbookworm0.13.0-2vulnerable
Ubuntuusbredirpro0.7-1ubuntu2vulnerable
Ubuntuusbredirpro0.7.1-1vulnerable
Ubuntuusbredirpro0.7.1-1ubuntu0.16.04.1~esm1vulnerable
Ubuntuusbredir18.040.7.1-1vulnerable
Ubuntuusbredir18.040.7.1-1ubuntu0.18.04.1vulnerable
Ubuntuusbredir20.040.8.0-1vulnerable
Ubuntuusbredir20.040.8.0-1ubuntu0.1vulnerable
Ubuntuusbredir22.040.8.0-1build1vulnerable
Ubuntuusbredir22.040.11.0-2vulnerable
Ubuntuusbredir22.040.11.0-2build1vulnerable
Ubuntuusbredir24.040.13.0-2vulnerable
Ubuntuusbredir24.040.13.0-2.1vulnerable
Ubuntuusbredir24.040.13.0-2.1build1vulnerable
Ubuntuusbredir26.100.15.0-1build1vulnerable
Ubuntuusbredir26.040.15.0-1vulnerable
Ubuntuusbredir26.040.15.0-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianusbredirsourcesid(unfixed)not yet assignedNot reported[1148831]
Debianusbredirsourceforky(unfixed)not yet assignedNot reported[1148831]
Debianusbredirsourcetrixie(unfixed)not yet assignedNot reported[1148831]
Debianusbredirsourcebookworm(unfixed)not yet assignedNot reported[1148831]

[Debian bug #1148831]

Notes

[trixie] usbredir: Revisit when fixed upstream [bookworm] usbredir: Revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libusbredirhost1]Affected

    Source package: [usbredir]

    Details (2)

    • 0.13.0-2 · amd64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

    • 0.13.0-2 · arm64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

  • [libusbredirhost-dev]Affected

    Source package: [usbredir]

    Details (2)

    • 0.13.0-2 · amd64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

    • 0.13.0-2 · arm64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

  • [libusbredirparser1]Affected

    Source package: [usbredir]

    Details (2)

    • 0.13.0-2 · amd64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

    • 0.13.0-2 · arm64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

  • [libusbredirparser-dev]Affected

    Source package: [usbredir]

    Details (2)

    • 0.13.0-2 · amd64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

    • 0.13.0-2 · arm64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

  • [usbredirect]Affected

    Source package: [usbredir]

    Details (2)

    • 0.13.0-2 · amd64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

    • 0.13.0-2 · arm64 · bookworm

      Affected

      dsa · usbredir · debian · bookworm; dsa · usbredir · debian · 12

[Debian 13 (Trixie)]

  • [libusbredirhost1t64]Affected

    Source package: [usbredir]

    Details (2)

    • 0.15.0-1 · amd64 · trixie

      Affected

      dsa · usbredir · debian · 13

    • 0.15.0-1 · arm64 · trixie

      Affected

      dsa · usbredir · debian · 13

  • [libusbredirhost-dev]Affected

    Source package: [usbredir]

    Details (2)

    • 0.15.0-1 · amd64 · trixie

      Affected

      dsa · usbredir · debian · 13

    • 0.15.0-1 · arm64 · trixie

      Affected

      dsa · usbredir · debian · 13

  • [libusbredirparser1t64]Affected

    Source package: [usbredir]

    Details (2)

    • 0.15.0-1 · amd64 · trixie

      Affected

      dsa · usbredir · debian · 13

    • 0.15.0-1 · arm64 · trixie

      Affected

      dsa · usbredir · debian · 13

  • [libusbredirparser-dev]Affected

    Source package: [usbredir]

    Details (2)

    • 0.15.0-1 · amd64 · trixie

      Affected

      dsa · usbredir · debian · 13

    • 0.15.0-1 · arm64 · trixie

      Affected

      dsa · usbredir · debian · 13

  • [usbredirect]Affected

    Source package: [usbredir]

    Details (2)

    • 0.15.0-1 · amd64 · trixie

      Affected

      dsa · usbredir · debian · 13

    • 0.15.0-1 · arm64 · trixie

      Affected

      dsa · usbredir · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]