libusb EUVD-2026-32500

libusb is a widely used portable C library providing generic, cross-platform access to USB devices. The vulnerable function parse_iad_array() in libusb/descriptor.c parses Interface Association Descriptors (IADs), which group related USB interfaces into composite device functions. The CWE-125 (Out-of-bounds Read) root cause is a classic off-by-one in the loop's remaining-bytes tracking: when iterating through a raw USB configuration descriptor buffer, the check uses the original total buffer length rather than the progressively decremented remaining length, so a descriptor whose bLength equals (total_size - 1) passes the check but positions the read pointer one byte beyond the allocation boundary on the next access. The two public API entry points that invoke this parser - libusb_get_active_interface_association_descriptors() and libusb_get_interface_association_descriptors() - are the externally-reachable surfaces. Fix commit 578ab76b4c434f8b204137ab6d7310689c7a9704 (v1.0.30) also introduces a dedicated OSS-Fuzz harness (fuzz_descriptor_parsers.c) using exact-size malloc copies with AddressSanitizer, and adds regression corpus file regression_bug_b_iad_oob.bin specifically for this bug class, confirming the issue was discovered or validated through fuzz testing.