Disclosures
STMicroelectronics · STM32Cube USB Host Library / Audio
USB Host Audio IN Interface Count Out-of-Bounds Write
SecMateSECMATE-2026-0025
VendorSTMicroelectronics
ProductSTM32Cube USB Host Library / Audio
Advisories
Timeline
Reported
Jan 2, 2026
Fixed
Jun 25, 2026
Published
Jul 2, 2026
Summary
STM32Cube USB Host Library 3.5.4 and earlier records AudioStreaming IN interfaces in a fixed five-entry array without bounding the alt_settings index. A malicious USB audio device can expose more than five matching interfaces during enumeration and cause an out-of-bounds write, memory corruption, or a host crash. ST fixed the issue in USB Host Library 3.5.5.