CVE catalog

CVE-2026-23679

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface clai

[CVE catalog]

Severity
Medium · CVSS 6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 25, 2026

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibusb-1.0sid2:1.0.30-1fixed
Debianlibusb-1.0forky2:1.0.30-1fixed
Debianlibusb-1.0trixie2:1.0.28-1vulnerable
Debianlibusb-1.0bookworm2:1.0.26-1vulnerable
Cpelibusb-1.0Not reportedNot reportedvulnerable
CpelibusbNot reported1.0.30fixed
CpelibusbNot reported1.0.30fixed
Suselibusb-1_0linux enterprise server 16.01.0.28-160000.3.1fixed
Suselibusb-1_0linux enterprise server for sap applications 16.01.0.28-160000.3.1fixed
Suselibusb-1_0linux enterprise server 16.01.0.28-160000.3.1fixed
Suselibusb-1_0linux enterprise server for sap applications 16.01.0.28-160000.3.1fixed
Suselibusb-1_0linux micro 6.11.0.27-slfo.1.1_2.1fixed
Suselibusb-1_0linux micro 6.21.0.28-160000.3.1fixed
Suselibusb-1_0linux micro 6.01.0.27-2.1fixed
Suselibusb-1_0linux enterprise server ltss extended security 12 sp51.0.20-7.3.1fixed
Suselibusb-1_0linux enterprise micro 5.31.0.24-150400.3.6.1fixed
Suselibusb-1_0linux enterprise micro 5.41.0.24-150400.3.6.1fixed
Suselibusb-1_0linux enterprise micro 5.51.0.24-150400.3.6.1fixed
Suselibusb-1_0linux enterprise module for basesystem 15 sp71.0.24-150400.3.6.1fixed
Suselibusb-1_0linux enterprise module for package hub 15 sp71.0.24-150400.3.6.1fixed
Opensuselibusb-1_0leap 16.01.0.28-160000.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibusb-1.0sourcesid2:1.0.30-1not yet assignedNot reportedNot reported
Debianlibusb-1.0sourceforky2:1.0.30-1not yet assignedNot reportedNot reported
Debianlibusb-1.0sourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibusb-1.0sourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpelibusbcpeNot reported1.0.30Not reportedNot reportedNot reported
CpelibusbcpeNot reported1.0.30Not reportedNVD-CVE-2026-23679Not reported
Suselibusb-1_0rpmlinux enterprise server 16.01.0.28-160000.3.1Not reportedSUSE-SU-2026:23660-1Not reported
Suselibusb-1_0rpmlinux enterprise server for sap applications 16.01.0.28-160000.3.1Not reportedSUSE-SU-2026:23660-1Not reported
Suselibusb-1_0rpmlinux enterprise server 16.01.0.28-160000.3.1Not reportedSUSE-SU-2026:23644-1Not reported
Suselibusb-1_0rpmlinux enterprise server for sap applications 16.01.0.28-160000.3.1Not reportedSUSE-SU-2026:23644-1Not reported
Suselibusb-1_0rpmlinux micro 6.11.0.27-slfo.1.1_2.1Not reportedSUSE-SU-2026:23519-1Not reported
Suselibusb-1_0rpmlinux micro 6.21.0.28-160000.3.1Not reportedSUSE-SU-2026:23501-1Not reported
Suselibusb-1_0rpmlinux micro 6.01.0.27-2.1Not reportedSUSE-SU-2026:23450-1Not reported
Suselibusb-1_0rpmlinux enterprise server ltss extended security 12 sp51.0.20-7.3.1Not reportedSUSE-SU-2026:4080-1Not reported
Suselibusb-1_0rpmlinux enterprise micro 5.31.0.24-150400.3.6.1Not reportedSUSE-SU-2026:4050-1Not reported
Suselibusb-1_0rpmlinux enterprise micro 5.41.0.24-150400.3.6.1Not reportedSUSE-SU-2026:4050-1Not reported
Suselibusb-1_0rpmlinux enterprise micro 5.51.0.24-150400.3.6.1Not reportedSUSE-SU-2026:4050-1Not reported
Suselibusb-1_0rpmlinux enterprise module for basesystem 15 sp71.0.24-150400.3.6.1Not reportedSUSE-SU-2026:4050-1Not reported
Suselibusb-1_0rpmlinux enterprise module for package hub 15 sp71.0.24-150400.3.6.1Not reportedSUSE-SU-2026:4050-1Not reported
Opensuselibusb-1_0rpmleap 16.01.0.28-160000.3.1Not reportedOPENSUSE-SU-2026:21783-1Not reported

Notes

[trixie] libusb-1.0: Minor issue [bookworm] libusb-1.0: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libusb-1.0-0]Affected

    Source package: [libusb-1.0]

    Details (2)

    • 2:1.0.26-1 · amd64 · bookworm

      Affected

      nvd · libusb-1.0 · debian · bookworm

    • 2:1.0.26-1 · arm64 · bookworm

      Affected

      nvd · libusb-1.0 · debian · bookworm

  • [libusb-1.0-0-dev]Affected

    Source package: [libusb-1.0]

    Details (2)

    • 2:1.0.26-1 · amd64 · bookworm

      Affected

      nvd · libusb-1.0 · debian · bookworm

    • 2:1.0.26-1 · arm64 · bookworm

      Affected

      nvd · libusb-1.0 · debian · bookworm

  • [libusb-1.0-doc]Affected

    Source package: [libusb-1.0]

    Details (2)

    • 2:1.0.26-1 · all · bookworm

      Affected

      nvd · libusb-1.0 · debian · bookworm

    • 2:1.0.26-1 · all · bookworm

      Affected

      nvd · libusb-1.0 · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]