CVE-2026-47104

MEDIUM EPSS 3.0%
Published May 27, 20261mo ago · Modified Jun 17, 20262w ago
5.1 CVSS 4.0
Medium
Find Similar
Published May 27, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

CVSS Details

Base Score
5.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
3.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 1

VendorProductVersionRange
libusblibusb* <1.0.30

References 5

  • github.com https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704
    Patch
  • github.com https://github.com/libusb/libusb/issues/1813
    Issue TrackingMitigation
  • github.com https://github.com/libusb/libusb/pull/1814
    Issue TrackingPatch
  • github.com https://github.com/libusb/libusb/releases/tag/v1.0.30
    ProductRelease Notes
  • vulncheck.com https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704
    Patch
  • github.com https://github.com/libusb/libusb/pull/1814
    Issue TrackingPatch
  • vulncheck.com https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array
    PatchThird Party Advisory