CVE-2026-23679

Name	CVE-2026-23679
Description	libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libusb-1.0 (PTS)	bullseye	2:1.0.24-3	vulnerable
	bookworm	2:1.0.26-1	vulnerable
	trixie	2:1.0.28-1	vulnerable
	forky, sid	2:1.0.30-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libusb-1.0	source	(unstable)	2:1.0.30-1

Notes

[trixie] - libusb-1.0 <no-dsa> (Minor issue)
[bookworm] - libusb-1.0 <no-dsa> (Minor issue)
https://github.com/libusb/libusb/issues/1813
https://github.com/libusb/libusb/pull/1814
https://github.com/libusb/libusb/commit/bc0886173ea15b8cc9bba2918f58a97a7f185231 (v1.0.30-rc2)