CVE-2026-23679 libusb < 1.0.30 NULL Pointer Dereference in parse_interface()
Attackers can crash applications using libusb by supplying malformed USB configuration descriptors that trigger a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23679?
CVE-2026-23679 is a medium-severity vulnerability in libusb, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
Weakness: CWE-125
Which versions are affected by CVE-2026-23679?
1 open source package ship an affected version, including libusb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libusb PyPI | All versions | 1.0.30 |
Linux distribution packages (6)
libusb-1_0 SUSE:Linux Enterprise Micro 5.3 | All versions | 1.0.24-150400.3.6.1 |
libusb-1_0 SUSE:Linux Enterprise Micro 5.4 | All versions | 1.0.24-150400.3.6.1 |
libusb-1_0 SUSE:Linux Enterprise Micro 5.5 | All versions | 1.0.24-150400.3.6.1 |
libusb-1_0 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.0.24-150400.3.6.1 |
libusb-1_0 SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 1.0.24-150400.3.6.1 |
libusb-1_0 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.0.20-7.3.1 |
Products include Libusb Libusb.
How do I fix CVE-2026-23679?
Upgrade libusb to 1.0.30 or later.
Is CVE-2026-23679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23679 exists.
Other vulnerabilities in libusb
Sources
Also known as AZL-88412, AZL-88791, AZL-89153, BELL-CVE-2026-23679, DEBIAN-CVE-2026-23679, ECHO-9b94-4c06-2947 and 8 more.