USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS
Impact
USB Test, a Windows CLI utility, has a heap-based buffer overflow vulnerability in versions prior to 1.1.5. A malicious USB storage device can cause out-of-bounds writes or a divide-by-zero denial of service. This may crash the application or potentially permit code execution.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
n-romanovich · GitHub_M
usb-test
1 range
n-romanovich · GitHub_M
usb-test
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 1.1.5
Other versions: unknown
Original source description
USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), §or, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116776View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-116776
Observed 2026-10-29T18:54:07.980Z · upstream updated 2026-10-29T18:37:18.070Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-29T18:36:46.958376Z", "decisions": [ { "name": "Exploitation", "value": "poc" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.