Critical
Security advisory
A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-42553
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:53 UTC · Revision 1
Source evidence
A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.
osv:CVE-2021-42553
Complete source record
{
"id": "62ba06268e03bb9f1ded10b15f53865e542031fc76c18dba68c502454b01c2dd",
"url": "https://osv.dev/vulnerability/CVE-2021-42553",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-42553",
"summary": "A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.",
"evidence": "osv:CVE-2021-42553",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2021-42553",
"aliases": [
"CVE-2021-42553"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/STMicroelectronics/stm32-mw-usb-host",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "38bc365e09b89c43b495af7261e31fe90a07335c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:st:stm32_mw_usb_host:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.5.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.5.0",
"v3.4.1",
"v3.4.0",
"v3.3.5",
"v3.3.4",
"v3.3.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-42553.json",
"vanir_signatures": [
{
"id": "CVE-2021-42553-34558313",
"digest": {
"threshold": 0.9,
"line_hashes": [
"118757189412808123883011596788122090666",
"294667195086430173860741692290097171141",
"187214976403033433262228332552118895945",
"137593365942804554308118282916426684867",
"291743261773558538913181851473181815724",
"260965498145777677279161969622068292321",
"81307865633653044523715750062154126950",
"182549894355162921880637443123959807508",
"301162919746761003319096839076056283767",
"124968190509980897496689359131446923269",
"137390176746861958459788026219318081218",
"80495478909957398172814431486051757337",
"208055177229135412279420259539903455348",
"14560101632762531518675057492232782613",
"153030586356154005336452994923539720910",
"16584116413551807105246457151873222717",
"210487852908437705905940403739834702258",
"33262388619799095687826892789662997288",
"219843744489677069728911090888202348253",
"190977689263187361247293466551740928154",
"315686833483779414553681503742526579867",
"240841403560123479243507627471161479157",
"67107639677730701250069737636899221797",
"198829222086163936202469044529065265240",
"183035321427877351947796026636472330082",
"104530799870143740031688989610416033612",
"74164044234099653483398976818513965751",
"310815255382369357118322684513559788087",
"291968491637528452032075759668470281357"
]
},
"source": "https://github.com/STMicroelectronics/stm32-mw-usb-host/commit/38bc365e09b89c43b495af7261e31fe90a07335c",
"target": {
"file": "Core/Src/usbh_ctlreq.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-42553-5b472341",
"digest": {
"length": 211,
"function_hash": "101013018286272135665994875130552585540"
},
"source": "https://github.com/STMicroelectronics/stm32-mw-usb-host/commit/38bc365e09b89c43b495af7261e31fe90a07335c",
"target": {
"file": "Class/HID/Src/usbh_hid.c",
"function": "USBH_HID_GetHIDReportDescriptor"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42553-74d78860",
"digest": {
"length": 1364,
"function_hash": "315905044694454016631705563907559952530"
},
"source": "https://github.com/STMicroelectronics/stm32-mw-usb-host/commit/38bc365e09b89c43b495af7261e31fe90a07335c",
"target": {
"file": "Core/Src/usbh_ctlreq.c",
"function": "USBH_ParseDevDesc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42553-9faeb4ff",
"digest": {
"length": 575,
"function_hash": "205052923788993717612071099532273944080"
},
"source": "https://github.com/STMicroelectronics/stm32-mw-usb-host/commit/38bc365e09b89c43b495af7261e31fe90a07335c",
"target": {
"file": "Core/Src/usbh_ctlreq.c",
"function": "USBH_ParseInterfaceDesc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42553-a4428951",
"digest": {
"length": 2181,
"function_hash": "249341499873474908141161298497588837300"
},
"source": "https://github.com/STMicroelectronics/stm32-mw-usb-host/commit/38bc365e09b89c43b495af7261e31fe90a07335c",
"target": {
"file": "Core/Src/usbh_ctlreq.c",
"function": "USBH_ParseCfgDesc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42553-c0d75862",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260959252536352337365984465505563015773",
"147384568506523324819093248178793598121",
"208380567881834530330500807456090466536",
"260959252536352337365984465505563015773",
"147384568506523324819093248178793598121",
"283928008138869119225923979136231840689"
]
},
"source": "https://github.com/STMicroelectronics/stm32-mw-usb-host/commit/38bc365e09b89c43b495af7261e31fe90a07335c",
"target": {
"file": "Class/HID/Src/usbh_hid.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-42553-f98a0dd1",
"digest": {
"length": 204,
"function_hash": "82685008848690312917216062201946717037"
},
"source": "https://github.com/STMicroelectronics/stm32-mw-usb-host/commit/38bc365e09b89c43b495af7261e31fe90a07335c",
"target": {
"file": "Class/HID/Src/usbh_hid.c",
"function": "USBH_HID_GetHIDDescriptor"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:28:24Z"
}
}
],
"modified": "2026-10-20T14:28:24.838617270Z",
"provider": "osv",
"references": [
"https://github.com/STMicroelectronics/stm32_mw_usb_host/pull/4",
"https://github.com/STMicroelectronics/stm32_mw_usb_host"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-42553",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 389059,
"published_at": "2022-10-21T10:15:12.47+00:00"
}