CVE-2026-23679: libusb Out-of-bounds Read — Fix

Description

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Is your site exposed to CVE-2026-23679?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.2

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploit Prediction

0.0019

Probability of exploitation

0.09%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-125 Out-of-bounds Read

Affected Products

Vendor	Product	Versions
libusb	libusb	< 1.0.30

References

Advisories & Patches

https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704 https://github.com/libusb/libusb/pull/1814 https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface

Other References

https://github.com/libusb/libusb/issues/1813 https://github.com/libusb/libusb/releases/tag/v1.0.30 https://github.com/libusb/libusb/issues/1813

Frequently Asked Questions

What is CVE-2026-23679? +

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash. It has a CVSS v3.1 base score of 6.2 (MEDIUM).

How severe is CVE-2026-23679? +

CVE-2026-23679 has a CVSS v3.1 score of 6.2 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0019, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-23679? +

CVE-2026-23679 affects products from libusb, specifically: libusb. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-23679? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-29013

libcoap contains out-of-bounds read vulnerabilities in OSCORE Appendix B.2 CBOR unwrap handling where get_byte_inc() in src/oscore/oscore_cbor.c relies solely on assert() …

CVE-2026-53566

Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: …

CVE-2026-3508

An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system …

CVE-2025-48520

An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read …

CVE-2026-3894

Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, …

CVE-2025-4098

Horner Automation Cscape version 10.0 (10.0.415.2) SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to …

CVE-2026-23679