USB Device GET_STATUS Endpoint Address Out-of-Bounds Write

STM32Cube USB Device Library 2.11.5 and earlier validates only the low endpoint-number bits of a GET_STATUS request before using a wider attacker-controlled endpoint address to index fixed endpoint arrays. A malicious USB host can set additional address bits and cause an out-of-bounds status write, resulting in memory corruption or a device crash. ST fixed the issue in USB Device Library 2.11.6.