PatchSiren cyber security CVE debrief
CVE-2026-23679 libusb CVE debrief
libusb versions prior to 1.0.30 contain a NULL pointer dereference vulnerability in the `parse_interface()` function. The flaw occurs when a malformed USB configuration descriptor claims `bNumEndpoints > 0` but is followed by a class-specific descriptor with a `bLength` exceeding the remaining buffer size. This causes early return from `parse_interface()` without allocating the endpoint array, leaving a NULL pointer that triggers a crash when applications iterate over endpoints via `libusb_get_active_config_descriptor` or `libusb_get_config_descriptor`. Attack vectors include virtualized USB passthrough, file-based descriptor parsing, and network sources supplying crafted descriptors. The vulnerability was disclosed on 2026-05-27 and affects applications using libusb for USB device enumeration.
- Vendor
- libusb
- Product
- Unknown
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-27
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-27
Who should care
Organizations using libusb in security-sensitive applications, virtualization platforms with USB passthrough, embedded systems with USB device enumeration, and developers of USB management tools or security scanning software that processes untrusted USB descriptors.
Technical summary
The vulnerability exists in libusb's descriptor parsing logic where `parse_interface()` fails to allocate the `endpoint` array when encountering malformed class-specific descriptors that trigger early return. The function sets `interface->endpoint = NULL` but leaves `interface->bNumEndpoints > 0`, creating an inconsistency. Subsequent code paths that iterate from 0 to `bNumEndpoints-1` and access `interface->endpoint[i]` dereference NULL, causing a crash. The fix ensures proper allocation or error handling before returning. The CVSS 4.0 vector indicates local attack vector with high availability impact (AV:L/VA:H).
Defensive priority
medium
Recommended defensive actions
- Upgrade libusb to version 1.0.30 or later to obtain the fix for the NULL pointer dereference in parse_interface()
- Validate USB configuration descriptors from untrusted sources (virtualized passthrough, network, or file-based inputs) before processing with libusb functions
- Monitor application logs for crashes in libusb_get_active_config_descriptor or libusb_get_config_descriptor calls that may indicate exploitation attempts
- Review applications that iterate over USB endpoints to ensure graceful handling of NULL endpoint arrays as a defense-in-depth measure
- Apply principle of least privilege to USB device access, restricting untrusted or virtualized USB passthrough where possible
Evidence notes
Vulnerability disclosed via Vulncheck advisory with GitHub commit, issue, and pull request references. Fix committed in libusb/libusb@578ab76b4c434f8b204137ab6d7310689c7a9704 and released in v1.0.30.
Official resources
2026-05-27