CVE-2026-23679: libusb before 1.0.30 (exclusive), 0 to before 1.0.30

Affected technology

libusb · before 1.0.30 (exclusive)
libusb

libusb · 0 to before 1.0.30
libusb

Description’s affected range: before version 1.0.30

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as none; availability impact as high.