Out-of-Bounds Read Vulnerability in libusb Affects Various Platforms

CVE-2026-47104

What is CVE-2026-47104?

An out-of-bounds read vulnerability has been identified in libusb prior to version 1.0.30, specifically within the parse_iad_array() function in descriptor.c. This flaw permits attackers to exploit malformed USB descriptors that can cause a denial of service. In environments with USB passthrough enabled, such as virtual machines, an attacker can provide crafted descriptors through functions like libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors, leading to a read operation that exceeds the allocated buffer. This could have serious implications for system stability and requires immediate attention to patch the affected libusb versions.

References