{"action":"Upgrade libusb to 1.0.30 or later.","affected":[{"fixed":"1.0.30","introduced":"0"}],"component":"libusb","cve_ids":["CVE-2026-47104"],"ecosystem":"PyPI","epss":0.0013,"exploited":false,"fixed_versions":["1.0.30"],"id":"tcs_01M5KH91WWGMD62BRTCRV0DE7X","modified_at":"2026-09-11T12:00:03.919336692Z","published_at":"2026-05-27T14:17:32.590Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3979","https://github.com/libusb/libusb/releases/tag/v1.0.30","https://github.com/libusb/libusb/issues/1813","https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704","https://github.com/libusb/libusb/pull/1814","https://www.vulncheck.com/advisories/libusb-out-of-bounds-read-in-parse-iad-array"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-3979","url":"https://osv.dev/vulnerability/PYSEC-2026-3979"}],"summary":"libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB"}