CVE-2026-23679

{"id": "CVE-2026-23679", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23679", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T15:44:53.658670Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/libusb/libusb", "vendor": "libusb", "product": "libusb", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.30", "versionType": "semver"}], "packageURL": "pkg:github/libusb/libusb", "defaultStatus": "affected"}]}], "published": "2026-05-27T14:16:44.170", "references": [{"url": "https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/libusb/libusb/issues/1813", "tags": ["Issue Tracking", "Mitigation"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/libusb/libusb/pull/1814", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/libusb/libusb/releases/tag/v1.0.30", "tags": ["Product", "Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface", "tags": ["Patch", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/libusb/libusb/issues/1813", "tags": ["Issue Tracking", "Mitigation"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash."}, {"lang": "es", "value": "libusb anterior a la versi\u00f3n 1.0.30 contiene una vulnerabilidad de desreferencia de puntero NULL que permite a los atacantes bloquear aplicaciones al proporcionar un descriptor de configuraci\u00f3n USB malformado donde una interfaz declara bNumEndpoints mayor que cero pero es seguida por un descriptor espec\u00edfico de clase cuyo bLength excede el tama\u00f1o restante del b\u00fafer, lo que provoca que parse_interface() retorne prematuramente sin asignar el array de puntos finales. Los atacantes pueden explotar esta falla a trav\u00e9s de libusb_get_active_config_descriptor o libusb_get_config_descriptor al proporcionar descriptores manipulados a trav\u00e9s de passthrough USB virtualizado, an\u00e1lisis de descriptores basado en archivos o fuentes de red, lo que provoca que cualquier aplicaci\u00f3n que itere sobre los puntos finales desreferencie un puntero de punto final NULL y se bloquee."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libusb:libusb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED05FDD2-4306-4649-AC78-E43E99ED647A", "versionEndExcluding": "1.0.30"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}