CVE-2025-68622: Stack-based Buffer Overflow

Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class UVC device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-990104)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990104 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvcfunctionsetup permit...

Linux UVC Driver DoS

The vulnerability in the drivers/media/usb/uvc/uvcdriver.c and drivers/media/usb/uvc/uvcvideo.h files of the UVC driver for the Linux operating system is related to incorrect assignment of identifiers. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2025-40016

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Mark invalid entities with id UVCINVALIDENTITYID Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. Each Unit and Terminal within the video function is assigned a unique...

CVE-2025-40016

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Mark invalid entities with id UVCINVALIDENTITYID Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. Each Unit and Terminal within the video function is assigned a unique...

CVE-2025-40016

CVE-2025-40016 affects the Linux kernel uvcvideo path. The fix marks entities with invalid IDs (UVC_INVALID_ENTITY_ID) to enforce non-zero unique IDs for Units and Terminals as required by UVC 1.1+. The change aims to prevent invalid or duplicate IDs (e.g., 0x00 or repeated IDs) from propagating ...

CVE-2025-55676 Windows USB Video Class System Driver Information Disclosure Vulnerability

...

CVE-2025-55676

CVE-2025-55676 affects the Windows USB Video Class System Driver and is an information disclosure vulnerability that can be exploited locally on an authenticated system. The root cause is an error message generation that reveals sensitive information from the Windows USB Video Driver. Microsoft’s...

CVE-2025-55676 Windows USB Video Class System Driver Information Disclosure Vulnerability

...

Windows USB Video Class System Driver Information Disclosure Vulnerability

Generation of error message containing sensitive information in Windows USB Video Driver allows an authorized attacker to disclose information locally...

Microsoft Windows USB Video Class driver 安全漏洞

Microsoft Windows USB Video Class driver is a driver for webcams or digital camcorders from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows USB Video Class driver, which can be exploited by attackers to obtain sensitive information...

EUVD-2024-40718

Malicious code in bioql PyPI...

PT-2025-42784

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained an issue in the uvcvideo driver related to handling of Universal Video Class UVC entities. Specifically, the driver did not properly mark invalid entities with...

CVE-2025-38558

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcgframebasedmake due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca...

CVE-2025-38558

In CVE-2025-38558, the Linux kernel USB gadget VAR: uvc frame-based format previously crashed when color_matching descriptor was missing, due to a NULL pointer dereference. The fix initializes the color matching descriptor for frame-based formats, mirroring the handling already present for uncomp...

CVE-2025-38558 usb: gadget: uvc: Initialize frame-based format color matching descriptor

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcgframebasedmake due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca...

Linux Distros Unpatched Vulnerability : CVE-2022-48948

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvcfunctionsetup permits control transfer requests with up to 64 bytes of payload...

CLSA-2025-1754552669 kernel: Fix of 12 CVEs

net: ch9200: fix uninitialised access during miinwayrestart CVE-2025-38086 - idpf: fix null-ptr-deref in idpffeaturescheck CVE-2025-38053 - ftrace: Fix NULL pointer dereference in isftracetrampoline when ftrace is dead CVE-2022-49977 - sched/fair: Fix potential memory corruption in...

kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

A vulnerability was found in the Linux kernel's USB Video Class driver. A buffer for video frame data is allocated, which does not account for all of the frame formats contained in a video stream, leading to an out-of-bounds write when a stream includes frames with an undefined format. An attacke...

Security update for kernel-livepatch-MICRO-6-0_Update_2

This update for kernel-livepatch-MICRO-6-0Update2 fixes the following issues: CVE-2024-57882: Fixed mptcp: fix TCP options overflow. bsc1235916 CVE-2024-46818: Fixed drm/amd/display: check gpioid before used as array index bsc1231204 CVE-2024-46815: Fixed drm/amd/display: check numvalidsets befor...