JLSEC-2026-665

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-665.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-665.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-665

Upstream

CVE-2026-23679

EUVD-2026-32502

GHSA-jp69-qvgm-mqwx

Published

2026-07-14T14:59:33.004Z

Modified

2026-07-25T18:24:45.251446902Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers...

Details

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

Database specific

{
    "sources": [
        {
            "imported": "2026-07-17T22:22:04.035Z",
            "id": "CVE-2026-23679",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-23679",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23679",
            "modified": "2026-07-14T16:16:52.027Z",
            "database_specific": {
                "status": "Modified"
            },
            "published": "2026-05-27T14:16:44.170Z"
        },
        {
            "id": "GHSA-jp69-qvgm-mqwx",
            "url": "https://api.github.com/advisories/GHSA-jp69-qvgm-mqwx",
            "html_url": "https://github.com/advisories/GHSA-jp69-qvgm-mqwx",
            "modified": "2026-05-27T15:33:19Z",
            "imported": "2026-07-17T22:22:04.198Z",
            "published": "2026-05-27T15:33:11Z"
        },
        {
            "id": "EUVD-2026-32502",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-32502",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32502",
            "modified": "2026-07-14T15:53:32Z",
            "imported": "2026-07-17T22:22:14.114Z",
            "published": "2026-05-27T13:21:37Z"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / libusb_jll

Package

Name: libusb_jll
Purl: pkg:julia/libusb_jll?uuid=a877fdc9-fe69-5ed6-b93d-11ecd0dc2d49

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.30+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-665.json"