CVE-2026-23679

A flaw was found in libusb. An attacker can provide a specially crafted Universal Serial Bus (USB) configuration descriptor to applications using libusb. This malformed descriptor can lead to a null pointer dereference, causing the application to crash and resulting in a denial of service. This vulnerability can be exploited via virtualized USB passthrough, file-based descriptor parsing, or network sources.

This Moderate flaw in libusb can lead to a denial of service when processing a specially crafted USB configuration descriptor. Exploitation requires an application to handle such a malformed descriptor, which can occur through virtualized USB passthrough, file-based parsing, or network sources. This issue primarily impacts system availability and does not enable arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.