CVE-2026-23679 Details
Description
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
A NULL pointer dereference vulnerability has been identified in libusb versions prior to 1.0.30. This vulnerability allows attackers to crash applications by sending a malformed USB configuration descriptor. The issue arises when an interface claims to have endpoints but is followed by a descriptor that exceeds the remaining buffer size. This causes the 'parse_interface()' function to exit prematurely without allocating the necessary endpoint array. The vulnerability can be exploited through 'libusb_get_active_config_descriptor' or 'libusb_get_config_descriptor' by using crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources. As a result, any application that iterates over endpoints may dereference a NULL pointer, leading to a crash.
Users can upgrade to libusb version 1.0.30 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libusb/libusb/issues/1813 | CISA-ADP | Issue TrackingMitigation |
| https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704 | [email protected] | Patch |
| https://github.com/libusb/libusb/issues/1813 | [email protected] | Issue TrackingMitigation |
| https://github.com/libusb/libusb/pull/1814 | [email protected] | Issue TrackingPatch |
| https://github.com/libusb/libusb/releases/tag/v1.0.30 | [email protected] | ProductRelease Notes |
| https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libusb libusb | < 1.0.30 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | [email protected] |