insta360-gfpt (>=0.1.6, <=0.2.0) potentially affected by CVE-2026-47104 via libusb (1.0.24b3)

libusb PYPI version 1.0.24b3 is affected by a known vulnerability. The following packages have a transitive dependency on libusb and may be impacted: - insta360-gfpt =0.1.6, =0.2.0 Source cves: CVE-2026-47104 Source advisory: OSV:PYSEC-2026-3979...

CVE-2026-47104 libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()

libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parseiadarray in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer...