Log in Start free

Vulnerability · Published May 27, 2026 · Assigned by VulnCheck

CVE-2026-47104libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()

Medium 4.0

In plain English

A medium-severity out-of-bounds read in libusb from libusb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.1%top 97.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libusb-1.0no fix listedDEBIAN-CVE-2026-47104
Debian:13libusb-1.0no fix listedDEBIAN-CVE-2026-47104
Debian:14libusb-1.02:1.0.30-1DEBIAN-CVE-2026-47104
PyPIlibusb1.0.30PYSEC-2026-3979
Ubuntu:22.04:LTSlibusbno fix listedUBUNTU-CVE-2026-47104
Ubuntu:24.04:LTSlibusbno fix listedUBUNTU-CVE-2026-47104
Ubuntu:25.10libusbno fix listedUBUNTU-CVE-2026-47104
Ubuntu:26.04:LTSlibusbno fix listedUBUNTU-CVE-2026-47104

Affected products (as reported)

VendorProductVersions
libusb libusb 0 – before 1.0.30

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References