A null pointer dereference occurs in the uvc_scan_streaming function of libuvc version 0.0.7 or earlier, allowing a local attacker to cause a crash when scanning USB video device descriptors. The defect can be leveraged by manipulating camera input data, leading to an application termination or system instability. Because the exploit is publicly available, local systems that rely on libuvc are at risk of denial of service.

The vulnerability affects the libuvc library, specifically versions up to and including 0.0.7. Systems that integrate libuvc for USB video device handling—such as applications or services that depend on this library for camera support—are impacted. No specific vendor release notes are available yet, and the issue is reported in the libuvc project’s issue tracker.

The CVSS score of 4.8 places the vulnerability in the moderate range, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wider field. The exploit requires local access and is not included in CISA’s KEV catalog. The attack vector is inferred to be local because the vulnerability is triggered by USB device interaction that a local attacker can control. Consequently, the risk is primarily for environments where USB cameras are enabled for local users or services.