PT-2026-43696 · Libusb · Libusb

Djnn · Published 2026-05-27 · Updated 2026-06-02 · CVE-2026-23679

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libusb versions prior to 1.0.30

Description A NULL pointer dereference occurs when a malformed USB configuration descriptor is supplied. Specifically, if an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor with a bLength exceeding the remaining buffer size, the parse interface() function returns early without allocating the endpoint array. This can be exploited via the functions libusb get active config descriptor or libusb get config descriptor by providing crafted descriptors through network sources, file-based descriptor parsing, or virtualized USB passthrough, leading to an application crash when iterating over endpoints.

Recommendations Update to version 1.0.30 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-23679

ECHO-9B94-4C06-2947

Affected Products

Libusb

References · 13

• 🔥 https://github.com/libusb/libusb/issues/1813 · Exploit
• https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704 · Patch
• https://github.com/libusb/libusb/pull/1814 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23679 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23679 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23679 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23679 · Vendor Advisory
• https://vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface · Patch
• https://cve.org/CVERecord?id=CVE-2026-23679 · Security Note
• https://ubuntu.com/security/CVE-2026-23679 · Vendor Advisory
• https://github.com/libusb/libusb/releases/tag/v1.0.30 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-23679 · Note