The vulnerability in pam_usb before version 0.9.1 arises from the src/conf.c source file allocating heap memory proportional to n_devices, a count derived from libxml2 XPath evaluation of the configuration file, without enforcing an upper bound. On 32-bit architectures like armv7l and i686, the multiplication n_devices * sizeof(t_pusb_device) overflows size_t, resulting in a small allocation size passed to xmalloc(). Since xmalloc() only aborts on NULL returns and accepts small non-NULL allocations, subsequent writes overflow the heap buffer. This is a classic heap-based buffer overflow (CWE-122) triggered by integer overflow (CWE-190). The vulnerability is resolved in pam_usb version 0.9.1.

Successful exploitation can lead to heap-based buffer overflow, potentially allowing an attacker with local privileges to execute arbitrary code, cause denial of service, or escalate privileges. The CVSS vector indicates local attack vector with low complexity, requiring high privileges and no user interaction, impacting confidentiality, integrity, and availability. There are no known exploits in the wild as of the published date.

Upgrade pam_usb to version 0.9.1 or later, where this vulnerability is fixed. Since the vendor advisory or patch links are not provided, verify the version in use and apply the official update from the mcdope project to remediate this issue. Patch status is not explicitly confirmed beyond the fix in 0.9.1; check the vendor's official resources for the latest remediation guidance.