The vulnerability is a one-byte out‑of‑bounds read in the parse_iad_array() function of libusb prior to version 1.0.30. When a USB descriptor of length one byte shorter than the buffer is supplied, the bounds check incorrectly references the original buffer size, causing libusb to read a byte past the allocated memory. This memory read does not result in a crash but can trigger a denial‑of‑service condition within the library or any application using libusb. The weakness is classified as CWE‑125 and has a CVSS score of 5.1, indicating moderate severity. Attackers can exploit the issue by providing crafted USB descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors calls.

The affected product is the libusb library, before release 1.0.30. Versions 1.0.30 and later contain the fix. No additional vendors or products are listed, so the scope is limited to systems that ship or use the vulnerable libusb library.

The CVSS score of 5.1 reflects a moderate risk of denial of service when a malicious USB descriptor is processed. EPSS data is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers must be able to supply or trick the system into processing a malformed USB descriptor, typically by having control over a USB device or by enabling USB passthrough in a virtualized environment. The likely attack vector is local or privileged access to devices that interact with libusb; remote exploitation would require remote USB passthrough capabilities.