NULL Pointer Dereference Vulnerability in libusb Affects Multiple Applications

CVE-2026-23679

What is CVE-2026-23679?

libusb versions prior to 1.0.30 are susceptible to a NULL pointer dereference vulnerability that arises when an interface claims a number of endpoints greater than zero, but is immediately followed by a class-specific descriptor whose length exceeds the remaining buffer. This can lead to premature termination of the parse_interface() function without proper allocation of the endpoint array. Attackers can exploit this vulnerability by feeding malformed USB configuration descriptors via libusb_get_active_config_descriptor or libusb_get_config_descriptor. Possible exploitation vectors include virtualized USB passthrough, file-based descriptor parsing, or network sources. Such an attack can result in an application crashing when it attempts to iterate over endpoints due to dereferencing a NULL pointer.

References