# CVE-2026-23679: libusb-1.0: libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applica...

CVE-2026-23679 is fixed in 9 products on 1 platform, first by ALAS2023-2026-1848, released June 22, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-23679
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 27, 2026

## Description

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libusb-1.0 Debian 14 | 2:1.0.30-1 | [DEBIAN-CVE-2026-23679](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23679.md) | Jun 24, 2026 |
| Linux | libusb-1_0 opensuse-leap 16.0 | 1.0.28-160000.3.1 | [OPENSUSE-SU-2026:21783-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21783-1.md) | Sep 7, 2026 |
| Linux | libusb-1_0 sles 15.7 | 1.0.24-150400.3.6.1 | [SUSE-SU-2026:4050-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4050-1.md) | Sep 7, 2026 |
| Linux | libusb-1_0 sles 16.0 | 1.0.28-160000.3.1 | [SUSE-SU-2026:23660-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23660-1.md) | Sep 7, 2026 |
| Linux | libusbx amzn 2023 | 1.0.24-2.amzn2023.0.3 | [ALAS2023-2026-1848](https://patchblox.com/security/data/fix/linux/alas2023-2026-1848.md) | Jun 22, 2026 |
| Linux | libusbx-debuginfo amzn 2023 | 1.0.24-2.amzn2023.0.3 | [ALAS2023-2026-1848](https://patchblox.com/security/data/fix/linux/alas2023-2026-1848.md) | Jun 22, 2026 |
| Linux | libusbx-debugsource amzn 2023 | 1.0.24-2.amzn2023.0.3 | [ALAS2023-2026-1848](https://patchblox.com/security/data/fix/linux/alas2023-2026-1848.md) | Jun 22, 2026 |
| Linux | libusbx-devel amzn 2023 | 1.0.24-2.amzn2023.0.3 | [ALAS2023-2026-1848](https://patchblox.com/security/data/fix/linux/alas2023-2026-1848.md) | Jun 22, 2026 |
| Linux | libusbx-devel-doc amzn 2023 | 1.0.24-2.amzn2023.0.3 | [ALAS2023-2026-1848](https://patchblox.com/security/data/fix/linux/alas2023-2026-1848.md) | Jun 22, 2026 |
| Linux | libusbx-tests-examples amzn 2023 | 1.0.24-2.amzn2023.0.3 | [ALAS2023-2026-1848](https://patchblox.com/security/data/fix/linux/alas2023-2026-1848.md) | Jun 22, 2026 |
| Linux | libusbx-tests-examples-debuginfo amzn 2023 | 1.0.24-2.amzn2023.0.3 | [ALAS2023-2026-1848](https://patchblox.com/security/data/fix/linux/alas2023-2026-1848.md) | Jun 22, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.