libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in
    descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor
    whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of
    the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted
    descriptors through libusb_get_active_interface_association_descriptors or
    libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation,
    resulting in a denial of service. (CVE-2026-47104)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21783-1 advisory.

    - CVE-2026-23679: NULL pointer dereference in `parse_interface()` allows attackers to crash applications     by supplying a       malformed USB configuration descriptor (bsc#1266664).
    - CVE-2026-47104: one-byte out-of-bounds read in `parse_iad_array()` allows attackers to trigger a denial     of service       via a malformed USB descriptor (bsc#1266667).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in     descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor     whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of     the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted     descriptors through libusb_get_active_interface_association_descriptors or     libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation,     resulting in a denial of service. (CVE-2026-47104)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457660	Echo: libusb-1.0: security update to 2:1.0.28-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457660	Echo: libusb-1.0: security update to 2:1.0.28-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
343947	openSUSE 16 Security Update : libusb-1_0 (openSUSE-SU-2026:21783-1)	Nessus	SuSE Local Security Checks	Local	medium
317946	Linux Distros Unpatched Vulnerability : CVE-2026-47104	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-47104

medium

Tenable Plugins

medium

medium

medium

medium