Executive brief
libusb is a widely used library that allows applications to communicate with USB hardware. A vulnerability in how the library handles USB device information could allow a malicious or malformed USB device to crash any application that attempts to read its configuration. This results in a denial-of-service, potentially impacting system stability or the availability of software that relies on USB connectivity.
Technical details
A NULL pointer dereference exists in the parse_interface() function within descriptor.c. When a USB configuration descriptor claims a non-zero number of endpoints (bNumEndpoints) but is followed by a class-specific descriptor with an invalid length (bLength) that exceeds the remaining buffer, the function returns early. This early return occurs after the endpoint count is recorded but before the endpoint array is allocated. Subsequent calls to libusb_get_active_config_descriptor or libusb_get_config_descriptor by an application will result in a crash when the application attempts to iterate over the unallocated (NULL) endpoint array. This can be triggered via physical USB devices, virtualized USB passthrough, or malformed descriptor files. The issue is fixed in version 1.0.30.
Affected products
- libusb libusb < 1.0.30
Timeline
- 2026-04-25: patched: Fixes submitted via Pull Request 1814
- 2026-05-17: advisory: Version 1.0.30 released
- 2026-05-27: disclosed: CVE published to NVD
References
- https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704
- https://github.com/libusb/libusb/issues/1813
- https://github.com/libusb/libusb/pull/1814
- https://github.com/libusb/libusb/releases/tag/v1.0.30
- https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface