CVE-2025-38680 media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
A local attacker can trigger a one-byte out-of-bounds read in the Linux kernel's UVC video driver, potentially leaking sensitive memory contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38680?
CVE-2025-38680 is a high-severity vulnerability in Debian Debian Linux, published on 4 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()
The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes.
This can lead to an out-of-bounds read if the buffer has exactly 3 bytes.
Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().
Weakness: CWE-125
Which versions are affected by CVE-2025-38680?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38680?
Apply the vendor's patch.
Is CVE-2025-38680 being exploited?
There is no known exploitation of CVE-2025-38680 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-66806, AZL-73824, BELL-CVE-2025-38680, DEBIAN-CVE-2025-38680, GHSA-mxw2-rg24-m422, ROOT-OS-DEBIAN-11-CVE-2025-38680 and 4 more.