CVE-2026-47104 Details

A one-byte out-of-bounds read vulnerability has been identified in libusb versions prior to 1.0.30. The issue arises in the parse_iad_array() function within descriptor.c, where the vulnerability allows attackers to cause a denial-of-service condition. This is achieved by sending a malformed USB descriptor with a bLength value that is one byte less than the total size, which disrupts the bounds checking process. In virtualized environments with USB passthrough, crafted descriptors can be delivered through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors. This exploitation reads one byte beyond the allocated memory, leading to a denial-of-service situation.

Users can upgrade to libusb version 1.0.30 or later, where this vulnerability has been fixed.