CVE-2026-23679
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In libusb before version 1.0.30, a NULL pointer dereference vulnerability exists. An attacker can supply a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Consequently, any application iterating over endpoints may crash.
Risk Assessment
The organization faces application crashes when using libusb, especially in environments with USB virtualization or descriptor parsing from untrusted sources. This can disrupt critical services or embedded systems.
Recommendation
Immediately update libusb to version 1.0.30 or later. If updating is not possible, restrict access to libusb_get_active_config_descriptor and libusb_get_config_descriptor for untrusted descriptors.
Original NVD description (English source)
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.