---
id: CVE-2025-38680
title: 'media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

  The buffer length check before calling uvc_parse_format() only ensured
  that the buffer has at leas…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    9ad554217c9b945031c73df4e8176a475e2dea57
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    1e269581b3aa5962fdc52757ab40da286168c087
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    8343f3fe0b755925f83d60b05e92bf4396879758
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    ffdd82182953df643aa63d999b6f1653d0c93778
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    cac702a439050df65272c49184aef7975fe3eff2
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    424980d33b3f816485513e538610168b03fab9f1
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    6d4a7c0b296162354b6fc759a1475b9d57ddfaa6
  - >-
    Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c <
    782b6a718651eda3478b1824b37a8b3185d2740c
  - Linux 2.6.26
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:06:54.830329Z'
published: '2025-09-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:12:52.276Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38680'
references:
  - url: 'https://git.kernel.org/stable/c/9ad554217c9b945031c73df4e8176a475e2dea57'
  - url: 'https://git.kernel.org/stable/c/1e269581b3aa5962fdc52757ab40da286168c087'
  - url: 'https://git.kernel.org/stable/c/8343f3fe0b755925f83d60b05e92bf4396879758'
  - url: 'https://git.kernel.org/stable/c/ffdd82182953df643aa63d999b6f1653d0c93778'
  - url: 'https://git.kernel.org/stable/c/a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9'
  - url: 'https://git.kernel.org/stable/c/cac702a439050df65272c49184aef7975fe3eff2'
  - url: 'https://git.kernel.org/stable/c/424980d33b3f816485513e538610168b03fab9f1'
  - url: 'https://git.kernel.org/stable/c/6d4a7c0b296162354b6fc759a1475b9d57ddfaa6'
  - url: 'https://git.kernel.org/stable/c/782b6a718651eda3478b1824b37a8b3185d2740c'
tags:
  - cve.org
epss: 0.00187
epssPercentile: 0.08318
ingestedAt: '2026-11-05T22:38:32.009Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()

The buffer length check before calling uvc_parse_format() only ensured
that the buffer has at least 3 bytes (buflen > 2), buf the function
accesses buffer[3], requiring at least 4 bytes.

This can lead to an out-of-bounds read if the buffer has exactly 3 bytes.

Fix it by checking that the buffer has at least 4 bytes in
uvc_parse_format().

## Affected

- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < 9ad554217c9b945031c73df4e8176a475e2dea57`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < 1e269581b3aa5962fdc52757ab40da286168c087`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < 8343f3fe0b755925f83d60b05e92bf4396879758`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < ffdd82182953df643aa63d999b6f1653d0c93778`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < cac702a439050df65272c49184aef7975fe3eff2`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < 424980d33b3f816485513e538610168b03fab9f1`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < 6d4a7c0b296162354b6fc759a1475b9d57ddfaa6`
- `Linux >= c0efd232929c2cd87238de2cccdaf4e845be5b0c < 782b6a718651eda3478b1824b37a8b3185d2740c`
- `Linux 2.6.26`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.