Skip to main content
Disclosures

STMicroelectronics · STM32Cube USB Host Library / Audio

USB Host Audio OUT Interface Count Out-of-Bounds Write

SecMateSECMATE-2026-0026
VendorSTMicroelectronics
ProductSTM32Cube USB Host Library / Audio
Advisories
Timeline
Reported
Jan 2, 2026
Fixed
Jun 25, 2026
Published
Jul 2, 2026
Summary

STM32Cube USB Host Library 3.5.4 and earlier records AudioStreaming OUT interfaces in a fixed five-entry array without bounding the alt_settings index. A malicious USB audio device can expose more than five matching interfaces during enumeration and cause an out-of-bounds write, memory corruption, or a host crash. ST fixed the issue in USB Host Library 3.5.5.

What's hidden in yours?

Find out