CVE-2026-1991CWE-404CWE-476

libuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereference

Medium · published February 6, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

A vulnerability was detected in libuvc up to 0.0.7. Affected is the function uvc_scan_streaming of the file src/device.c of the component UVC Descriptor Handler. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00210 · 10.6th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-02-06T05:32Z
EPSS history
Timeline
  • 06 FEB 05:32Z
    libuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereference
    cvelistv5