libusb CVE-2026-23679

libusb is a widely embedded C library that provides userspace applications with generic, OS-independent access to USB devices. Descriptor parsing occurs in descriptor.c; the entry point parse_configuration() calls parse_interface() for each interface claimed by a USB configuration. The bug manifests when an interface descriptor sets bNumEndpoints greater than zero but the immediately following descriptor is a class-specific descriptor whose bLength field exceeds the remaining buffer size. The bounds check causes parse_interface() to return early before it executes the malloc() that allocates the endpoint array, leaving the pointer NULL. CWE-125 (Out-of-bounds Read) is the root cause class: the oversized bLength triggers an early-exit guard that was intended to protect against a read overrun, but the guard was placed incorrectly relative to the endpoint array allocation, creating a second-order NULL dereference when callers later iterate over the (non-existent) endpoints. The fix at commit 578ab76b4c434f8b204137ab6d7310689c7a9704 also introduces an OSS-Fuzz integration target (fuzz_descriptor_parsers.c) and three regression corpus binaries, confirming the issue was verified through fuzz testing before release.