{"schema":"threatline.record/2","record":{"id":"CVE-2026-116776","aliases":["GHSA-cfrv-c9q2-7cr3"],"summary":"USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS","details":"USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), &sector, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.","categories":["Unclassified"],"product":"usb-test","vendor":"n-romanovich","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116776","source_modified_at":"2026-10-28T15:42:11.023Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"usb-test","vendor":"n-romanovich","versions":[{"version":"< 1.1.5","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T15:42:11.023Z","modified_at":"2026-10-28T15:42:11.023Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116776","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T15:42:11.023Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/n-romanovich/usb-test/security/advisories/GHSA-cfrv-c9q2-7cr3","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/n-romanovich/usb-test/commit/5b6caac844461024520b02337d3a541fbe128f89","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/n-romanovich/usb-test/releases/tag/release-v1.1.5","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T15:42:11.023Z","content_hash":"9222fcc95b2fc1eef5459e9c28001faf9efc034582598b431dd3a232cd3a996d"}}