What is the CVSS score of CVE-2025-68622?

CVE-2025-68622 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Usb Host Uvc Class Driver are affected by CVE-2025-68622?

Organizations using Espressif ESP-IDF USB Host UVC Class Driver should be aware of notable risk from CVE-2025-68622, a stack-based buffer overflow vulnerability rated CVSS 6.8.. A patch is available.

How to fix or mitigate CVE-2025-68622?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Usb Host Uvc Class Driver CVE-2025-68622

MEDIUM

Stack-based Buffer Overflow (CWE-121)

2026-01-12 security-advisories@github.com

Buffer Overflow Usb Host Uvc Class Driver

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 22, 2026 - 15:50 nvd

Patch available

CVE Published

Jan 12, 2026 - 17:15 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. Because this value is not validated before being copied into a fixed-size stack buffer, an attacker can overflow the buffer and corrupt memory. This vulnerability is fixed in 2.4.0.

AnalysisAI

Technical ContextAI

This vulnerability (CWE-121: Stack-based Buffer Overflow) affects Usb Host Uvc Class Driver. Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation allows a malicious USB Video Class (UVC) device to trigger a stack buffer overflow during configuration-descriptor parsing. When UVC configuration-descriptor printing is enabled, the host prints detailed descriptor information provided by the connected USB device. A specially crafted UVC descriptor may advertise an excessively large length. B