CVE-2026-23679: Libusb

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Affected products

• Libusb Libusb: before 1.0.30 (fixed in 1.0.30)

Published 2026-05-27. Last modified 2026-07-14.