CVE-2021-42553: STM32 USB Host Library Buffer Overflow

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-21 · updated 2026-10-08
Weakness: CWE-120

Description

A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.

Affected products

STMicroelectronics STM32Cube STM32 USB Host Library: before 3.5.1 — fixed in 3.5.1

How to fix

Upgrade to a fixed version: STMicroelectronics STM32Cube STM32 USB Host Library 3.5.1. Check the vendor advisory for mitigations.

References

https://github.com/STMicroelectronics/stm32_mw_usb_host
https://github.com/STMicroelectronics/stm32_mw_usb_host/pull/4
https://github.com/STMicroelectronics/stm32_mw_usb_host
https://github.com/STMicroelectronics/stm32_mw_usb_host/pull/4

Get alerted when CVE-2021-42553 or the next vulnerability affects your stack