{"id":"CVE-2025-68622","aliases":["EUVD-2025-206283","GHSA-g65h-9ggq-9827"],"status":"published","title":"Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing","description":"Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00247,"percentile":0.16104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2026-01-12T17:08:22Z","modified":"2026-10-28T02:31:06Z","products":[{"vendor":"espressif","product":"esp-usb"},{"vendor":"espressif","product":"usb_host_uvc_class_driver"}],"references":[{"url":"https://github.com/espressif/esp-usb/security/advisories/GHSA-g65h-9ggq-9827","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory"]},{"url":"https://github.com/espressif/esp-usb/commit/77a38b15a17f6e3c7aeb620eb4aeaf61d5194cc0","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://components.espressif.com/components/espressif/usb_host_uvc/versions/2.4.0/changelog","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68622.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68622","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68622","title":"Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing","description":"Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.","status":"published","published":"2026-01-12T17:08:22.941Z","modified":"2026-01-12T18:37:35.287Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-206283","description":"Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.","status":"published","published":"2026-01-12T17:08:22Z","modified":"2026-01-12T18:37:35Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:53.22038Z"}],"nvd":[{"id":"CVE-2025-68622","description":"Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.","status":"published","published":"2026-01-12T17:15:53.05Z","modified":"2026-06-17T09:59:21.827Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-68622","title":"Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing","description":"Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.","status":"published","published":"2026-01-12T17:08:22.941Z","modified":"2026-10-28T02:31:06.326156174Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:52.53036Z"}]}}