Every CVE Search/ Get API key

CVE-2026-47104

libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()

5.1 MediumFix available

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.13%Up 0.1 points since May 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
CVE-2026-47104
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-32500 5.1

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
EUVD-2026-32500
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-fh6g-r8pf-wqgw 5.1

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in...

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
GHSA-fh6g-r8pf-wqgw
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 5.1

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
CVE-2026-47104
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVBELL-CVE-2026-47104 5.5
Record
BELL-CVE-2026-47104
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.1

libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
CVE-2026-47104
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2026-47104 5.5

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
DEBIAN-CVE-2026-47104
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-666 5.1

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in...

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
JLSEC-2026-666
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2026-3979 5.5

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
PYSEC-2026-3979
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20075 6.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:20075
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-47104 5.1

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
UBUNTU-CVE-2026-47104
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-88409 No score

CVE-2026-47104 affecting package libusb1 1.0.27-4

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
AZL-88409
Updated
2026-11-05
OSVAZL-89156 No score

CVE-2026-47104 affecting package gpsbabel 1.8.0-4

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

Record
AZL-89156
Updated
2026-11-05
OSVopenSUSE-SU-2026:21783-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
openSUSE-SU-2026:21783-1
Updated
2026-11-02
OSVSUSE-SU-2026:23450-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23450-1
Updated
2026-11-02
OSVSUSE-SU-2026:23501-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23501-1
Updated
2026-11-02
OSVSUSE-SU-2026:23519-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23519-1
Updated
2026-11-02
OSVSUSE-SU-2026:23644-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23644-1
Updated
2026-11-02
OSVSUSE-SU-2026:23660-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23660-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libusb1
Azure Linux:3
 through 1.0.27-4 None known
gpsbabel
Azure Linux:3
 through 1.8.0-4 None known
libusb
Alpaquita:25
 1.0.28-r0 up to 1.0.28-r1
1.0.28-r1
libusb
Alpaquita:stream
 1.0.26-r0 up to 1.0.30-r0
1.0.30-r0
libusb-1.0
Debian:12
 All versions, plus listed versions
2:1.0.26-12:1.0.27-12:1.0.27-22:1.0.27~rc1-12:1.0.27~rc1-2
Show 11 moreShow less
2:1.0.27~rc1-32:1.0.27~rc1-42:1.0.27~rc1-52:1.0.27~rc2-12:1.0.28-12:1.0.28~rc1-12:1.0.29-12:1.0.29-22:1.0.30-12:1.0.30~rc1-12:1.0.30~rc2-1
 None known
libusb-1.0
Debian:13
 All versions, plus listed versions
2:1.0.28-12:1.0.29-12:1.0.29-22:1.0.30-12:1.0.30~rc1-12:1.0.30~rc2-1
 None known
libusb-1.0
Debian:14
 before 2:1.0.30-1, plus listed versions
2:1.0.28-12:1.0.29-12:1.0.29-22:1.0.30~rc1-12:1.0.30~rc2-1
2:1.0.30-1
libusb_jll
Julia
 before 1.0.30+0
1.0.30+0
libusb
PyPI
 before 1.0.30, plus listed versions
1.0.22b21.0.22b41.0.22b81.0.22b91.0.23b1
Show 26 moreShow less
1.0.23b71.0.24b11.0.24b31.0.261.0.26b21.0.26b31.0.26b41.0.26b51.0.26rc21.0.26rc41.0.271.0.27.post11.0.27.post21.0.27.post31.0.27.post41.0.281.0.28.post11.0.28.post21.0.291.0.29.post11.0.29.post31.0.29.post41.0.29.post61.0.29.post71.0.30rc11.0.30rc2
1.0.30
libusb1
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
libusb1-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
libusb1-devel-doc
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
libusb1-tests-examples
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
mingw32-libusb1
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
mingw64-libusb1
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
libusb-1_0
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 1.0.27-2.1
1.0.27-2.1
libusb-1_0
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1
libusb-1_0
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 1.0.27-slfo.1.1_2.1
1.0.27-slfo.1.1_2.1
libusb-1_0
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1
libusb-1_0
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1
libusb-1_0
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
affected
affected, aliases, published, referencesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-47104 is a medium vulnerability (CVSS 5.1) in Libusb, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in libusb 1.0.28-r1.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open