Description

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-21T18:17:14.593Z",
  "pubdate": "2026-09-21T18:17:14.593Z",
  "executiveSummary": "A critical out-of-bounds write vulnerability exists within the usbredir library, specifically affecting how isochronous OUT streams are handled.\nThe flaw allows a remote usbredir peer to trigger memory corruption by manipulating the transfer buffer submission state.\nBy initiating an isochronous OUT stream with a transfer count of 1, the system fails to submit the single transfer buffer, which subsequently bypasses established bounds checking mechanisms in usbredirhost_iso_packet().\nThis vulnerability grants an attacker the ability to write arbitrary data past the end of the packet descriptor array during subsequent isochronous packet processing.\nSuccessful exploitation can lead to memory corruption, potential code execution, or service instability within the context of the usbredir host process.\nThis vulnerability is particularly concerning as it relies on the protocol-level communication between a usbredir client and host, potentially exposing virtualized environments or networked USB redirection services to malicious input.\nThe risk is high, as the exploitation primitive allows for repeated out-of-bounds writes on every subsequent isochronous packet processed by the host, significantly increasing the probability of successful exploitation and system compromise.",
  "technicalDetails": "The vulnerability resides within the isochronous packet processing logic of the usbredir host-side implementation, specifically centered on the interaction between stream initialization and the packet descriptor management.\nThe root cause is a logic error in the state management of the transfer buffer when an isochronous OUT stream is configured with a transfer count of 1. Under these specific conditions, the buffer is left in an unsubmitted state within the library's internal structures.\nThe function usbredirhost_iso_packet() is designed to perform bounds checking before processing packet descriptors. However, this check is contingent upon the expected state of the transfer buffers associated with the stream. Because the initial buffer remains unsubmitted, the internal accounting fails to correctly increment the active pointer, causing the validation logic in usbredirhost_iso_packet() to believe the buffer offset is still within the permissible array boundaries.\nThe attack flow proceeds as follows: First, the attacker initiates a maliciously crafted isochronous OUT stream request specifying a transfer count of 1. Second, the usbredir host processes this request but fails to register or submit the buffer as intended. Third, the attacker proceeds to send standard isochronous packets. Because the host's internal tracking is out-of-sync, every subsequent packet causes the usbredirhost_iso_packet() function to write into memory addresses residing beyond the allocated bounds of the packet descriptor array.\nThis creates a persistent memory corruption primitive. Each subsequent packet sent by the peer results in a write operation that occurs outside the bounds of the intended data structure. An attacker can leverage this primitive to overwrite adjacent heap metadata or function pointers stored in adjacent memory, depending on the memory layout of the host application.\nThe impact is significant, as the vulnerability does not require authentication once the usbredir connection is established. It effectively allows a peer—which could be a malicious guest VM or a compromised redirection client—to escape the intended memory safety constraints of the usbredirhost module.\nExploitation requires the attacker to be able to establish a usbredir session and communicate using the isochronous transfer protocol. Post-exploitation, an attacker could potentially hijack the control flow of the host process or escalate privileges within the host environment, depending on the process memory map and the presence of protections such as ASLR or DEP, which may be bypassed by careful heap grooming facilitated by the repeated OOB write."
}