Description
libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libusb | libusb | < 1.0.30 | 1.0.30 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libusb-1.0 | 2:1.0.30-1 | — |
| Debian 13 | libusb-1.0 | No fix yet | — |
| Debian 12 | libusb-1.0 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libusb1 +5 | 1.0.30-1.hum1 | RHSA-2026:20075 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libusb-1_0 | 1.0.24-150400.3.6.1 | SUSE-SU-2026:4050-1 |
| SLES 12 SP5 | libusb-1_0 | 1.0.20-7.3.1 | SUSE-SU-2026:4080-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libusb-1_0 | 1.0.28-160000.3.1 | SUSE-SU-2026:23660-1, SUSE-SU-2026:23644-1 |
| SLES 16.0 | libusb-1_0 | 1.0.28-160000.3.1 | SUSE-SU-2026:23660-1, SUSE-SU-2026:23644-1 |
| SLE Micro 6.2 | libusb-1_0 | 1.0.28-160000.3.1 | SUSE-SU-2026:23501-1 |
| SLE Micro 6.1 | libusb-1_0 | 1.0.27-slfo.1.1_2.1 | SUSE-SU-2026:23519-1 |
| SLE Micro 6.0 | libusb-1_0 | 1.0.27-2.1 | SUSE-SU-2026:23450-1 |
| SLE Micro 5.5 | libusb-1_0 | 1.0.24-150400.3.6.1 | SUSE-SU-2026:4050-1 |
| SLE Micro 5.4 | libusb-1_0 | 1.0.24-150400.3.6.1 | SUSE-SU-2026:4050-1 |
| SLE Micro 5.3 | libusb-1_0 | 1.0.24-150400.3.6.1 | SUSE-SU-2026:4050-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | libusb-1_0 | 1.0.28-160000.3.1 | openSUSE-SU-2026:21783-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libusbx +3 | 1.0.24-2.amzn2023.0.3 | ALAS2023-2026-1848 |
| Amazon Linux 2 | libusbx +2 | 1.0.21-1.amzn2.0.1 | ALAS2-2026-3360 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libusb | 1.0.30-1 | — |
| Azure Linux 3 | libusb1 +1 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | libusb | < 1.0.30 | 1.0.30 | PYSEC-2026-3978 |
Advisories 11
- RHSA-2026:20075 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- SUSE-SU-2026:23660-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23644-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23519-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 15, 2026
- SUSE-SU-2026:23501-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:23450-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:4080-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:4050-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 13, 2026
- openSUSE-SU-2026:21783-1 Security update for libusb-1_0 SUSE / openSUSE Security Updates · Sep 9, 2026
- ALAS2-2026-3360 Moderate: libusbx security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- ALAS2023-2026-1848 Moderate: libusbx security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
References
- libusb 1.0.30 Release Notes release-notes
- https://github.com/libusb/libusb/issues/1813 issue-tracking
- https://github.com/libusb/libusb/pull/1814 issue-tracking patch
- https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704 patch
- https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface third-party-advisory