Description
libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libusb | libusb | < 1.0.30 | 1.0.30 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libusb-1.0 | 2:1.0.30-1 | — |
| Debian 13 | libusb-1.0 | No fix yet | — |
| Debian 12 | libusb-1.0 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libusb1 +5 | 1.0.30-1.hum1 | RHSA-2026:20075 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libusb-1_0 | 1.0.28-160000.3.1 | SUSE-SU-2026:23660-1, SUSE-SU-2026:23644-1 |
| SLES 16.0 | libusb-1_0 | 1.0.28-160000.3.1 | SUSE-SU-2026:23660-1, SUSE-SU-2026:23644-1 |
| SLE Micro 6.2 | libusb-1_0 | 1.0.28-160000.3.1 | SUSE-SU-2026:23501-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libusb-1_0 | 1.0.27-slfo.1.1_2.1 | SUSE-SU-2026:23519-1 |
| SLE Micro 6.0 | libusb-1_0 | 1.0.27-2.1 | SUSE-SU-2026:23450-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | libusb-1_0 | 1.0.28-160000.3.1 | openSUSE-SU-2026:21783-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libusb1 +1 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | libusb | < 1.0.30 | 1.0.30 | PYSEC-2026-3979 |
Advisories 7
- RHSA-2026:20075 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- SUSE-SU-2026:23660-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23644-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23519-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 15, 2026
- SUSE-SU-2026:23501-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:23450-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 14, 2026
- openSUSE-SU-2026:21783-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 9, 2026
References
- libusb 1.0.30 Release Notes release-notes
- https://github.com/libusb/libusb/issues/1813 issue-tracking
- https://github.com/libusb/libusb/pull/1814 issue-tracking patch
- https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704 patch
- https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array third-party-advisory