Every CVE Search/ Get API key

CVE-2026-23679

libusb < 1.0.30 NULL Pointer Dereference in parse_interface()

6.9 MediumFix available

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.18%Up 0.2 points since May 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

libusb < 1.0.30 NULL Pointer Dereference in parse_interface()

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
CVE-2026-23679
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-32502 6.9

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
EUVD-2026-32502
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jp69-qvgm-mqwx 6.9

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows...

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
GHSA-jp69-qvgm-mqwx
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 6.9

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
CVE-2026-23679
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVBELL-CVE-2026-23679 5.5
Record
BELL-CVE-2026-23679
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.9

libusb < 1.0.30 NULL Pointer Dereference in parse_interface()

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
CVE-2026-23679
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-02
Show 18 moreShow less
OSVDEBIAN-CVE-2026-23679 5.5

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
DEBIAN-CVE-2026-23679
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2026-665 6.9

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers...

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
JLSEC-2026-665
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2742 5.5

libusbx security update

libusb is a library for USB device access from Linux, macOS, Windows, OpenBSD/NetBSD and Haiku userspace. It is written in C (Haiku backend in C++) and licensed under the GNU Lesser General Public License version 2.1 or, at your option, any later version (see COPYING).

Security Fix(es):

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.(CVE-2026-23679)

Record
OESA-2026-2742
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2743 5.5

libusbx security update

libusb is a library for USB device access from Linux, macOS, Windows, OpenBSD/NetBSD and Haiku userspace. It is written in C (Haiku backend in C++) and licensed under the GNU Lesser General Public License version 2.1 or, at your option, any later version (see COPYING).

Security Fix(es):

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.(CVE-2026-23679)

Record
OESA-2026-2743
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVPYSEC-2026-3978 5.5

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
PYSEC-2026-3978
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20075 6.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:20075
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-23679 6.9

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
UBUNTU-CVE-2026-23679
CVSS 4.0
6.9 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-88412 No score

CVE-2026-23679 affecting package libusb1 1.0.27-4

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
AZL-88412
Updated
2026-11-05
OSVAZL-88791 No score

CVE-2026-23679 affecting package libusb for versions less than 1.0.30-1

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
AZL-88791
Updated
2026-11-05
OSVAZL-89153 No score

CVE-2026-23679 affecting package gpsbabel 1.8.0-4

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Record
AZL-89153
Updated
2026-11-05
OSVopenSUSE-SU-2026:21783-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
openSUSE-SU-2026:21783-1
Updated
2026-11-02
OSVSUSE-SU-2026:23450-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23450-1
Updated
2026-11-02
OSVSUSE-SU-2026:23501-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23501-1
Updated
2026-11-02
OSVSUSE-SU-2026:23519-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23519-1
Updated
2026-11-02
OSVSUSE-SU-2026:23644-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23644-1
Updated
2026-11-02
OSVSUSE-SU-2026:23660-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issues:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
  • CVE-2026-47104: one-byte out-of-bounds read in parse_iad_array() allows attackers to trigger a denial of service via a malformed USB descriptor (bsc#1266667).
Record
SUSE-SU-2026:23660-1
Updated
2026-11-02
OSVSUSE-SU-2026:4050-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issue:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
Record
SUSE-SU-2026:4050-1
Updated
2026-11-02
OSVSUSE-SU-2026:4080-1 No score

Security update for libusb-1_0

This update for libusb-1_0 fixes the following issue:

  • CVE-2026-23679: NULL pointer dereference in parse_interface() allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664).
Record
SUSE-SU-2026:4080-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libusb1
Azure Linux:3
 through 1.0.27-4 None known
libusb
Azure Linux:3
 before 1.0.30-1
1.0.30-1
gpsbabel
Azure Linux:3
 through 1.8.0-4 None known
libusb
Alpaquita:23
 1.0.26-r0 up to 1.0.26-r1
1.0.26-r1
libusb
Alpaquita:25
 1.0.28-r0 up to 1.0.28-r1
1.0.28-r1
libusb
Alpaquita:stream
 1.0.26-r0 up to 1.0.30-r0
1.0.30-r0
libusb-1.0
Debian:12
 All versions, plus listed versions
2:1.0.26-12:1.0.27-12:1.0.27-22:1.0.27~rc1-12:1.0.27~rc1-2
Show 11 moreShow less
2:1.0.27~rc1-32:1.0.27~rc1-42:1.0.27~rc1-52:1.0.27~rc2-12:1.0.28-12:1.0.28~rc1-12:1.0.29-12:1.0.29-22:1.0.30-12:1.0.30~rc1-12:1.0.30~rc2-1
 None known
libusb-1.0
Debian:13
 All versions, plus listed versions
2:1.0.28-12:1.0.29-12:1.0.29-22:1.0.30-12:1.0.30~rc1-12:1.0.30~rc2-1
 None known
libusb-1.0
Debian:14
 before 2:1.0.30-1, plus listed versions
2:1.0.28-12:1.0.29-12:1.0.29-22:1.0.30~rc1-12:1.0.30~rc2-1
2:1.0.30-1
libusb_jll
Julia
 before 1.0.30+0
1.0.30+0
Show 21 moreShow less
Affected packages
PackageAffectedFixed
libusbx
openEuler:24.03-LTS-SP1
 before 1.0.26-3.oe2403sp1
1.0.26-3.oe2403sp1
libusbx
openEuler:24.03-LTS-SP3
 before 1.0.26-3.oe2403sp3
1.0.26-3.oe2403sp3
libusb
PyPI
 before 1.0.30, plus listed versions
1.0.22b21.0.22b41.0.22b81.0.22b91.0.23b1
Show 26 moreShow less
1.0.23b71.0.24b11.0.24b31.0.261.0.26b21.0.26b31.0.26b41.0.26b51.0.26rc21.0.26rc41.0.271.0.27.post11.0.27.post21.0.27.post31.0.27.post41.0.281.0.28.post11.0.28.post21.0.291.0.29.post11.0.29.post31.0.29.post41.0.29.post61.0.29.post71.0.30rc11.0.30rc2
1.0.30
libusb1
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
libusb1-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
libusb1-devel-doc
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
libusb1-tests-examples
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
mingw32-libusb1
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
mingw64-libusb1
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.0.30-1.hum1
0:1.0.30-1.hum1
libusb-1_0
SUSE:Linux Micro 6.0
From an advisory covering 2 CVEs
 before 1.0.27-2.1
1.0.27-2.1
libusb-1_0
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1
libusb-1_0
SUSE:Linux Micro 6.1
From an advisory covering 2 CVEs
 before 1.0.27-slfo.1.1_2.1
1.0.27-slfo.1.1_2.1
libusb-1_0
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1
libusb-1_0
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1
libusb-1_0
SUSE:Linux Enterprise Micro 5.3
 before 1.0.24-150400.3.6.1
1.0.24-150400.3.6.1
libusb-1_0
SUSE:Linux Enterprise Micro 5.4
 before 1.0.24-150400.3.6.1
1.0.24-150400.3.6.1
libusb-1_0
SUSE:Linux Enterprise Micro 5.5
 before 1.0.24-150400.3.6.1
1.0.24-150400.3.6.1
libusb-1_0
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.0.24-150400.3.6.1
1.0.24-150400.3.6.1
libusb-1_0
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 1.0.24-150400.3.6.1
1.0.24-150400.3.6.1
libusb-1_0
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.0.20-7.3.1
1.0.20-7.3.1
libusb-1_0
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.0.28-160000.3.1
1.0.28-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-23679 is a medium vulnerability (CVSS 6.9) in Libusb, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in libusb 1.0.30-1.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open