PYSEC-2026-3978

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/libusb/PYSEC-2026-3978.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3978
Aliases
Published
2026-05-27T14:16:44Z
Modified
2026-09-11T12:00:03Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.

References

Affected packages

PyPI / libusb

Package

Name
libusb
View open source insights on deps.dev
Purl
pkg:pypi/libusb

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.30

Affected versions

1.*
1.0.22b2
1.0.22b4
1.0.22b8
1.0.22b9
1.0.23b1
1.0.23b7
1.0.24b1
1.0.24b3
1.0.26b2
1.0.26b3
1.0.26b4
1.0.26b5
1.0.26rc2
1.0.26rc4
1.0.26
1.0.27
1.0.27.post1
1.0.27.post2
1.0.27.post3
1.0.27.post4
1.0.28
1.0.28.post1
1.0.28.post2
1.0.29
1.0.29.post1
1.0.29.post3
1.0.29.post4
1.0.29.post6
1.0.29.post7
1.0.30rc1
1.0.30rc2

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/libusb/PYSEC-2026-3978.yaml"