CVE-2026-23679

MEDIUM 6.2

libusb < 1.0.30 NULL Pointer Dereference in parse_interface()

CVSS Score

6.2

EPSS Score

0.0%

EPSS Percentile

2th

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

CWE	CWE-125
Vendor	libusb
Product	libusb
Published	May 27, 2026
Last Updated	May 28, 2026

Stay Ahead of the Next One

Get instant alerts for libusb libusb

Be the first to know when new medium vulnerabilities affecting libusb libusb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

libusb / libusb

0 < 1.0.30

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/libusb/libusb/releases/tag/v1.0.30 github.com: https://github.com/libusb/libusb/issues/1813 github.com: https://github.com/libusb/libusb/pull/1814 github.com: https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704 vulncheck.com: https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface

Credits

djnn