{"id":"CVE-2021-42553","aliases":["EUVD-2021-29521","GHSA-vwmv-9r25-j98p","UBUNTU-CVE-2021-42553","USN-7472-1"],"status":"published","title":"STM32 USB Host Library Buffer Overflow","description":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01304,"percentile":0.70752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2022-10-21T00:00:00Z","modified":"2026-10-20T14:28:24Z","fixes":[{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"micropython","fixed_in":["1.12-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"micropython","fixed_in":["1.17+ds-1.1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"micropython","fixed_in":["1.22.1+ds-1ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1~esm1"}]}],"versions":["1.12-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17+ds-1.1ubuntu2+esm1"}]}],"versions":["1.17+ds-1ubuntu1","1.17+ds-1.1","1.17+ds-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1+ds-1ubuntu0.24.04.1~esm1"}]}],"versions":["1.19.1+ds-1","1.22.1+ds-1","1.22.1+ds-1build1","1.22.1+ds-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.1+ds-1","1.25.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0+ds-1","1.26.1+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1ubuntu0.1~esm1"}]}],"versions":["1.12-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17+ds-1.1ubuntu2+esm1"}]}],"versions":["1.17+ds-1ubuntu1","1.17+ds-1.1","1.17+ds-1.1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"micropython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1+ds-1ubuntu0.24.04.1~esm1"}]}],"versions":["1.19.1+ds-1","1.22.1+ds-1","1.22.1+ds-1build1","1.22.1+ds-1build2"],"bundled":3}],"products":[{"vendor":"st","product":"stm32_mw_usb_host"},{"vendor":"stmicroelectronics stm32cube","product":"stm32 usb host library"}],"references":[{"url":"https://github.com/STMicroelectronics/stm32_mw_usb_host/pull/4","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/STMicroelectronics/stm32_mw_usb_host","tags":["x_transferred","Product","package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42553"},{"url":"https://github.com/advisories/GHSA-vwmv-9r25-j98p"},{"url":"https://ubuntu.com/security/CVE-2021-42553","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42553","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7472-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-8946","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-8947","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-42553","title":"STM32 USB Host Library Buffer Overflow","description":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.","status":"published","published":"2022-10-21T00:00:00Z","modified":"2025-05-07T20:10:49.445Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:32:58.739039Z"}],"euvd":[{"id":"EUVD-2021-29521","description":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.","status":"published","published":"2022-10-21T00:00:00Z","modified":"2025-05-07T20:10:49Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:52.670412Z"}],"ghsa":[{"id":"GHSA-vwmv-9r25-j98p","title":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics allows an attacker to...","description":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.","status":"published","published":"2022-10-21T12:00:15Z","modified":"2023-03-15T05:06:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:54:20.892008Z"}],"nvd":[{"id":"CVE-2021-42553","description":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.","status":"published","published":"2022-10-21T10:15:12.47Z","modified":"2026-10-08T18:23:29.09Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-42553","description":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.","status":"published","published":"2022-10-21T10:15:12.47Z","modified":"2026-10-20T14:28:24.83861727Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"UBUNTU-CVE-2021-42553","description":"A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.","status":"published","published":"2022-10-21T10:15:00Z","modified":"2026-10-17T12:56:15.860718811Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"USN-7472-1","title":"micropython vulnerabilities","description":"Junwha Hong and Wonil Jang discovered that Micropython incorrectly handled\nthe length of a buffer in mp_vfs_umount, leading to a heap-based buffer \noverflow vulnerability. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could possibly use this issue\nto cause a denial of service or possibly execute arbitrary code.\n(CVE-2024-8946)\n\n\nJunwha Hong and Wonil Jang discovered that Micropython incorrectly handled\nmemory, leading to a use-after-free vulnerability under certain \ncircumstances. If a user or automated system were tricked into opening a \nspecially crafted file, an attacker could possibly use this issue to\ncause a denial of service or possibly execute arbitrary code. \n(CVE-2024-8947)\n\nIt was discovered that Middleware USB Host MCU Component incorrectly\nhandled memory, leading to a buffer overflow vulnerability, If a user or \nautomated system were tricked into opening a specially crafted file, an \nattacker could possibly use this issue to cause a denial of service or\npossibly execute arbitrary code. (CVE-2021-42553)\n","status":"published","published":"2025-05-01T13:04:26Z","modified":"2026-04-27T17:56:36.281355Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}