In breve
- CVE-2026-23679 è una vulnerabilità MEDIO (CVSS 5.5) che riguarda libusb, libusb (libusb).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.18%, superiore al 8.1% delle vulnerabilità.
- Correzione: aggiornare a 1.0.30 o successiva.
| Package | Affected versions | Patched versions |
|---|
| libusb PyPI | < 1.0.30
| 1.0.30
|
| libusb | < 1.0.30
| 1.0.30
|
Description
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
NVD description
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free