Bug 2482102 (CVE-2026-23679) - CVE-2026-23679 libusb: libusb: Denial of Service via malformed USB configuration descriptor
Summary: CVE-2026-23679 libusb: libusb: Denial of Service via malformed USB configurat...
Keywords:
Status: NEW
Alias: CVE-2026-23679
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2489178
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-27 15:11 UTC by OSIDB Bzimport
Modified: 2026-06-16 13:24 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-27 15:11:25 UTC
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.


Note You need to log in before you can comment on or make changes to this bug.