CVE-2025-68622: Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing
Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68622?
The severity of CVE-2025-68622 is classified as critical due to the potential for a stack buffer overflow that could lead to arbitrary code execution.
How do I fix CVE-2025-68622?
To fix CVE-2025-68622, upgrade to Espressif ESP-IDF USB Host UVC Class Driver version 2.4.0 or later.
What impact does CVE-2025-68622 have on my system?
CVE-2025-68622 can allow an attacker to exploit the stack buffer overflow to execute arbitrary code, potentially compromising the entire system.
What versions are affected by CVE-2025-68622?
CVE-2025-68622 affects all versions of Espressif ESP-IDF USB Host UVC Class Driver prior to version 2.4.0.
Can CVE-2025-68622 be exploited remotely?
Yes, CVE-2025-68622 can be exploited remotely if an attacker connects a malicious USB Video Class device to the affected system.