Source: usbredir Version: 0.15.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for usbredir. CVE-2026-92382[0]: | An out-of-bounds write flaw was found in usbredir. Starting an | isochronous OUT stream with a transfer count of 1 leaves the | stream's single transfer buffer permanently unsubmitted, defeating | the bounds check in usbredirhost_iso_packet() and allowing a | usbredir peer to write past the end of the packet descriptor array | on every subsequent isochronous packet. Unfortunately there is only the reference to the Red Hat bugzilla, which though is not public. SUSE has as well not more information in their tracker and searching for information. It might be worth filling an upstream issue to ask. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-92382 https://www.cve.org/CVERecord?id=CVE-2026-92382 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2535972 [2] https://bugzilla.suse.com/show_bug.cgi?id=1282260 Regards, Salvatore
