CVE-2026-22013 – Hardware Wallet USB Descriptor Buffer Overflow

Program Code (C firmware sim)

// hw_wallet_usb.c - USB descriptor parsing with fixed buffer
#include <string.h>
void handle_usb_setup(char *data, int len) {
    char descriptor[32];
    if (len > 0 && data[0] == 0x06) { // GET_DESCRIPTOR
        // Copy descriptor payload without bounds check
        memcpy(descriptor, data+1, len-1);  // overflow if len>33
    }
}
int main() {
    char malicious[64];
    memset(malicious, 'A', 63);
    malicious[0] = 0x06;
    handle_usb_setup(malicious, 64);
    return 0;
}

CVE-2026-22013 – Hardware Wallet USB Descriptor Buffer Overflow

Overview

A hardware wallet’s USB stack has a stack buffer overflow when parsing a GET_DESCRIPTOR request with an oversized payload. An attacker with physical USB access can exploit this to overwrite the return address and gain code execution, extracting seed phrases.

Vulnerability Details

• Type: Stack Buffer Overflow
• Impact: Complete device compromise, seed extraction.
• Root Cause: The descriptor length field is not validated before copying into a fixed‑size buffer.

Exploit Demonstration

Compile for target architecture and run (simulate):

gcc -o hw_wallet_usb hw_wallet_usb.c -fno-stack-protector
./hw_wallet_usb

The program crashes due to stack corruption.