CVE-2025-68622

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68622", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-19T18:50:09.991Z", "datePublished": "2026-01-12T17:08:22.941Z", "dateUpdated": "2026-01-12T18:37:35.287Z"}, "containers": {"cna": {"title": "Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing", "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "lang": "en", "description": "CWE-121: Stack-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/espressif/esp-usb/security/advisories/GHSA-g65h-9ggq-9827", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/espressif/esp-usb/security/advisories/GHSA-g65h-9ggq-9827"}, {"name": "https://github.com/espressif/esp-usb/commit/77a38b15a17f6e3c7aeb620eb4aeaf61d5194cc0", "tags": ["x_refsource_MISC"], "url": "https://github.com/espressif/esp-usb/commit/77a38b15a17f6e3c7aeb620eb4aeaf61d5194cc0"}, {"name": "https://components.espressif.com/components/espressif/usb_host_uvc/versions/2.4.0/changelog", "tags": ["x_refsource_MISC"], "url": "https://components.espressif.com/components/espressif/usb_host_uvc/versions/2.4.0/changelog"}], "affected": [{"vendor": "espressif", "product": "esp-usb", "versions": [{"version": "< 2.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T17:08:22.941Z"}, "descriptions": [{"lang": "en", "value": "Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0."}], "source": {"advisory": "GHSA-g65h-9ggq-9827", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T18:37:25.103214Z", "id": "CVE-2025-68622", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:37:35.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68622", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-12T18:37:25.103214Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:37:30.893Z"}}], "cna": {"title": "Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing", "source": {"advisory": "GHSA-g65h-9ggq-9827", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "espressif", "product": "esp-usb", "versions": [{"status": "affected", "version": "< 2.4.0"}]}], "references": [{"url": "https://github.com/espressif/esp-usb/security/advisories/GHSA-g65h-9ggq-9827", "name": "https://github.com/espressif/esp-usb/security/advisories/GHSA-g65h-9ggq-9827", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/espressif/esp-usb/commit/77a38b15a17f6e3c7aeb620eb4aeaf61d5194cc0", "name": "https://github.com/espressif/esp-usb/commit/77a38b15a17f6e3c7aeb620eb4aeaf61d5194cc0", "tags": ["x_refsource_MISC"]}, {"url": "https://components.espressif.com/components/espressif/usb_host_uvc/versions/2.4.0/changelog", "name": "https://components.espressif.com/components/espressif/usb_host_uvc/versions/2.4.0/changelog", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T17:08:22.941Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68622", "state": "PUBLISHED", "dateUpdated": "2026-01-12T18:37:35.287Z", "dateReserved": "2025-12-19T18:50:09.991Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T17:08:22.941Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "esp-usb", "vendor": "espressif", "versions": [{"status": "affected", "version": "< 2.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:espressif:usb_host_uvc_class_driver:*:*:*:*:*:*:*:*", "matchCriteriaId": "106F8B83-D544-4E82-B369-FA77389285F9", "versionEndExcluding": "2.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0."}, {"lang": "es", "value": "El controlador de clase UVC de host USB de Espressif ESP-IDF permite la transmisi\u00f3n de video desde c\u00e1maras USB. Antes de la versi\u00f3n 2.4.0, una vulnerabilidad en la implementaci\u00f3n de host UVC de esp-usb permite que un dispositivo malicioso de clase de video USB (UVC) active un desbordamiento de b\u00fafer de pila durante el an\u00e1lisis del descriptor de configuraci\u00f3n. Cuando la impresi\u00f3n del descriptor de configuraci\u00f3n UVC est\u00e1 habilitada, el host imprime informaci\u00f3n detallada del descriptor proporcionada por el dispositivo USB conectado. Un descriptor UVC especialmente dise\u00f1ado puede anunciar una longitud excesivamente grande. Debido a que este valor no se valida antes de ser copiado en un b\u00fafer de pila de tama\u00f1o fijo, un atacante puede desbordar el b\u00fafer y corromper la memoria. Esta vulnerabilidad se corrige en la versi\u00f3n 2.4.0."}], "id": "CVE-2025-68622", "lastModified": "2026-06-17T09:59:21.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68622", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T18:37:25.103214Z", "version": "2.0.3"}}]}, "published": "2026-01-12T17:15:53.050", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://components.espressif.com/components/espressif/usb_host_uvc/versions/2.4.0/changelog"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/espressif/esp-usb/commit/77a38b15a17f6e3c7aeb620eb4aeaf61d5194cc0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/espressif/esp-usb/security/advisories/GHSA-g65h-9ggq-9827"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-01-13T09:27:29.544907+00:00", "updated": "2026-01-13T09:27:29.544941+00:00", "vendors": ["espressif", "espressif$PRODUCT$esp-usb"]}