Executive brief
libusb is a widely used library that allows software to communicate with USB devices. A vulnerability in how the library processes device information could allow a malicious or malformed USB device to crash the application using the library. This is particularly relevant in virtualized environments where a guest operating system is granted direct access to a physical USB device.
Technical details
An out-of-bounds read exists in the parse_iad_array() function within descriptor.c of libusb. The vulnerability is caused by an incorrect bounds check where the code compares a descriptor's bLength against the original buffer size instead of the remaining bytes. By providing a malformed USB descriptor (e.g., where bLength equals the remaining size minus one), an attacker can cause the parser to read one byte past the end of the allocated memory buffer. This can be triggered via public APIs such as libusb_get_active_interface_association_descriptors. The issue is primarily exploitable by a malicious USB device or in virtualized environments with USB passthrough, resulting in a crash (denial of service). The vulnerability was fixed in version 1.0.30.
Affected products
- libusb libusb < 1.0.30
Timeline
- 2026-04-25: disclosed: Issue reported on GitHub
- 2026-05-17: patched: Fixed in version 1.0.30
- 2026-05-27: advisory: NVD publication date
References
- https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704
- https://github.com/libusb/libusb/issues/1813
- https://github.com/libusb/libusb/pull/1814
- https://github.com/libusb/libusb/releases/tag/v1.0.30
- https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array