[libusb] Coordinated Vulnerability Disclosure - libusb Null Pointer Dereference

[Wade S. <ws...@vu...>]

Hello libusb mailing list,

I’m a vulnerability analyst at VulnCheck <https://www.vulncheck.com/>, an
exploit intelligence company and research CVE Numbering Authority (CNA),
where I'm one of several folks who manage our coordinated vulnerability
disclosure (CVD) program.

An external security researcher recently reported
<https://www.vulncheck.com/advisories/report> a vulnerability
impacting the libusb
<https://github.com/libusb/libusb>codebase (discovered when testing against
version 1.0.29), and VulnCheck is acting as the intermediary and
coordinator.

VulnCheck follows a 120-day disclosure policy
<https://www.vulncheck.com/vulnerability-disclosure-policy>, meaning we
afford vendors/maintainers up to 120 days from the time of receiving the
report to address the issue before publication of a CVE record and
third-party advisory. For this vulnerability, that 120-day deadline falls
on *August 7 2026*.

We have provisionally reserved the following CVE ID, which have been shared
with the researcher but will remain private until public disclosure:
*CVE-2026-23679*

Please be aware that none of this information is public at this moment and
all parties involved are considered under embargo. The researcher has
provided us with a comprehensive technical report including reproduction
steps. Once an appropriate medium and point of contact are identified, we'd
be happy to share those materials with your team.

If interested in VulnCheck's previous disclosures, you may find those here
<https://www.vulncheck.com/advisories>.

Let us know if you have any questions for us about the CVD process or for
the researcher regarding the reported vulnerability.

Best regards,

<https://www.vulncheck.com/>

Wade Sparks III
VulnCheck
Senior Vulnerability Analyst