libusb up to 1.0.29 descriptor.c parse_iad_array out-of-bounds

Summaryinfo

A vulnerability categorized as problematic has been discovered in libusb up to 1.0.29. Affected by this vulnerability is the function parse_iad_array of the file descriptor.c. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2026-47104. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in libusb up to 1.0.29. It has been declared as problematic. This vulnerability affects the function parse_iad_array of the file descriptor.c. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect availability. CVE summarizes:

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

The weakness was presented by @MarkLee131 as 1813. The advisory is shared for download at github.com. This vulnerability was named CVE-2026-47104 since 05/18/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 317946 (Linux Distros Unpatched Vulnerability : CVE-2026-47104), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.0.30 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 578ab76b4c434f8b204137ab6d7310689c7a9704 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (317946). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• libusb

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29

License

• open-source

Website

• Product: https://github.com/libusb/libusb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion