High 7.1Published Sep 4, 2025

CVE-2025-38680media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

Updated under an hour ago (Oct 26, 2026, 2:20 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c0efd232929c2cd87238de2cccdaf4e845be5b0c before 9ad554217c9b945031c73df4e8176a475e2dea57; from c0efd232929c2cd87238de2cccdaf4e845be5b0c before 1e269581b3aa5962fdc52757ab40da286168c087; from c0efd232929c2cd87238de2cccdaf4e845be5b0c before 8343f3fe0b755925f83d60b05e92bf4396879758; from c0efd232929c2cd87238de2cccdaf4e845be5b0c before ffdd82182953df643aa63d999b6f1653d0c93778; from c0efd232929c2cd87238de2cccdaf4e845be5b0c before a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9; from c0efd232929c2cd87238de2cccdaf4e845be5b0c before cac702a439050df65272c49184aef7975fe3eff2; from c0efd232929c2cd87238de2cccdaf4e845be5b0c before 424980d33b3f816485513e538610168b03fab9f1; from c0efd232929c2cd87238de2cccdaf4e845be5b0c before 6d4a7c0b296162354b6fc759a1475b9d57ddfaa6; and 1 more ranges	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.27 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2; and 2 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/9ad554217c9b945031c73df4e8176a475e2dea57	patch
https://git.kernel.org/stable/c/1e269581b3aa5962fdc52757ab40da286168c087	patch
https://git.kernel.org/stable/c/8343f3fe0b755925f83d60b05e92bf4396879758	patch
https://git.kernel.org/stable/c/ffdd82182953df643aa63d999b6f1653d0c93778	patch
https://git.kernel.org/stable/c/a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9	patch
https://git.kernel.org/stable/c/cac702a439050df65272c49184aef7975fe3eff2	patch
https://git.kernel.org/stable/c/424980d33b3f816485513e538610168b03fab9f1	patch
https://git.kernel.org/stable/c/6d4a7c0b296162354b6fc759a1475b9d57ddfaa6	patch
https://git.kernel.org/stable/c/782b6a718651eda3478b1824b37a8b3185d2740c	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.