p PatchFirst

CVE-2026-23679

CVE-2026-23679 · libusb < 1.0.30 NULL Pointer Dereference in parse_interface()

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

CVSS 6.9 · Media · EPSS 0,2% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system · python

Productos y versiones afectados

  • libusb

    Versiones
    • ≥ 0, < 1.0.30: Afectada (semver)

    Actualiza a 1.0.30

  • libusb-1.0 Debian:12

    Versiones
    • 2:1.0.26-1
    • 2:1.0.27-1
    • 2:1.0.27-2
    • 2:1.0.27~rc1-1
    • 2:1.0.27~rc1-2
    • 2:1.0.27~rc1-3
    • 2:1.0.27~rc1-4
    • 2:1.0.27~rc1-5
    • 2:1.0.27~rc2-1
    • 2:1.0.28-1
    • 2:1.0.28~rc1-1
    • 2:1.0.29-1
    • 2:1.0.29-2
    • 2:1.0.30-1
    • 2:1.0.30~rc1-1
    • 2:1.0.30~rc2-1
    Intervalos de versiones afectados
    • ECOSYSTEM: (−∞, +∞)

    Sin corrección publicada

  • libusb-1.0 Debian:13

    Versiones
    • 2:1.0.28-1
    • 2:1.0.29-1
    • 2:1.0.29-2
    • 2:1.0.30-1
    • 2:1.0.30~rc1-1
    • 2:1.0.30~rc2-1
    Intervalos de versiones afectados
    • ECOSYSTEM: (−∞, +∞)

    Sin corrección publicada

  • libusb-1.0 Debian:14

    Versiones
    • 2:1.0.28-1
    • 2:1.0.29-1
    • 2:1.0.29-2
    • 2:1.0.30~rc1-1
    • 2:1.0.30~rc2-1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2:1.0.30-1

    Actualiza a 2:1.0.30-1

  • libusb PyPI

    Versiones
    • 1.0.22b2
    • 1.0.22b4
    • 1.0.22b8
    • 1.0.22b9
    • 1.0.23b1
    • 1.0.23b7
    • 1.0.24b1
    • 1.0.24b3
    • 1.0.26
    • 1.0.26b2
    • 1.0.26b3
    • 1.0.26b4
    • 1.0.26b5
    • 1.0.26rc2
    • 1.0.26rc4
    • 1.0.27
    • 1.0.27.post1
    • 1.0.27.post2
    • 1.0.27.post3
    • 1.0.27.post4
    • 1.0.28
    • 1.0.28.post1
    • 1.0.28.post2
    • 1.0.29
    • 1.0.29.post1
    • 1.0.29.post3
    • 1.0.29.post4
    • 1.0.29.post6
    • 1.0.29.post7
    • 1.0.30rc1
    • 1.0.30rc2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.0.30

    Actualiza a 1.0.30

Fuentes originales

Comprueba tu servidor →