{"action":"Upgrade libusb to 1.0.30 or later.","affected":[{"fixed":"1.0.30","introduced":"0"}],"component":"libusb","cve_ids":["CVE-2026-23679"],"ecosystem":"PyPI","epss":0.00184,"exploited":false,"fixed_versions":["1.0.30"],"id":"tcs_01M5KH91PN8FRR6G7GSPRMJ4DQ","modified_at":"2026-09-11T12:00:03.923366646Z","published_at":"2026-05-27T14:16:44.170Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3978","https://github.com/libusb/libusb/releases/tag/v1.0.30","https://github.com/libusb/libusb/issues/1813","https://github.com/libusb/libusb/commit/578ab76b4c434f8b204137ab6d7310689c7a9704","https://github.com/libusb/libusb/pull/1814","https://www.vulncheck.com/advisories/libusb-null-pointer-dereference-in-parse-interface"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-3978","url":"https://osv.dev/vulnerability/PYSEC-2026-3978"}],"summary":"libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface clai"}