CVE-2026-116776— USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS

Quick assessment

Affected

n-romanovich usb-test

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

USB Test 是一款轻量级的 Windows 命令行工具，用于验证 USB 闪存盘的扇区完整性并检测容量虚报问题。在 1.1.5 版本之前，中的函数在调用获取时，未验证该调用是否成功，也未对返回值进行大小边界检查。随后将该值用于除法运算，并据此分配堆缓冲区，之后执行。因此，若用户连接了恶意的 USB 存储设备，该设备可报告小于 8 字节的扇区大小，从而引发重复的越界写入；或报告 0 字节，导致用户在启动驱动器测试时发生除以零错误，造成拒绝服务（DoS）。堆内存损坏可能导致以高权限运行的应用程序崩溃，

CVSS 7.0 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution

Affected Version Matrix 1

Vendor	Product	Version Range	Status
n-romanovich	usb-test	`< 1.1.5`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS

Source: CVE Program / CVE List V5

Vulnerability Description

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize() in USB Test/src/driveinfo.cpp trusts DISK_GEOMETRY.BytesPerSector returned by IOCTL_DISK_GET_DRIVE_GEOMETRY without checking whether the call succeeded or enforcing size bounds. USB Test/src/drivetest.cpp uses the value for division and to size a heap buffer before memcpy(buffer.data(), &sector, 8), so a physically connected malicious USB storage device can report a value below eight bytes and cause repeated out-of-bounds writes, or report zero and cause a divide-by-zero denial of service when a user starts a drive test. The heap corruption can crash the elevated application and may permit arbitrary code execution. This issue is fixed in version 1.1.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
n-romanovich	usb-test	< 1.1.5	-

II. Public POCs for CVE-2026-116776

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116776

请登录查看更多情报信息。

Other References for CVE-2026-116776 (3)

https://github.com/n-romanovich/usb-test/releases/tag/release-v1.1.5 x_refsource_MISC
https://github.com/n-romanovich/usb-test/security/advisories/GHSA-cfrv-c9q2-7cr3 x_refsource_CONFIRM
https://github.com/n-romanovich/usb-test/commit/5b6caac844461024520b02337d3a541fbe128f89 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-116776

IV. Related Vulnerabilities

Same weakness: CWE-122