The vulnerability is a NULL pointer dereference in the parse_interface() function of libusb. It occurs when a USB configuration descriptor contains an interface that claims one or more endpoints but is followed by a class‑specific descriptor whose length exceeds the remaining buffer length. The function returns early without allocating the endpoint array, leaving a NULL endpoint pointer that applications will dereference, causing a crash. The weakness is identified as CWE‑125, a buffer overread scenario. No evidence in the description indicates arbitrary code execution; the main impact is to terminate the application, which can degrade service availability.

Any software that links against libusb versions earlier than 1.0.30 on any operating system is potentially affected. This includes devices or applications that query USB descriptors through libusb_get_active_config_descriptor or libusb_get_config_descriptor, especially those that accept descriptors from untrusted virtualized USB passthrough, file-based sources, or network streams.

The CVSS score of 6.9 classifies the issue as a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Likely attack vectors require an attacker to supply a malformed USB descriptor to the library, which could be done via virtual USB passthrough in virtualized environments or by feeding crafted descriptors through network interfaces that are parsed by applications using libusb. Because the flaw only causes a crash and not code execution, the primary threat is to availability rather than confidentiality or integrity.