A flaw in the ALSA FireWire driver for iSight cameras allows the payload packet sample count to exceed the allotted buffer size. Because the sample count is validated only against the packet length, an attacker can craft a packet that causes the driver to read beyond the provided samples and write past the DMA buffer boundary. This out-of-bounds write in kernel space can be leveraged to execute arbitrary code with elevated privileges. The weakness is a buffer overflow (CWE-120).

The vulnerability affects Linux kernel systems that use the ALSA FireWire driver for Apple iSight cameras. Systems built with Linux kernels prior to the patch commit that added a hard limit on the sample count are impacted. The flaw exists only on machines that have FireWire hardware and an iSight camera connected.

The CVSS score is 7.0, but the EPSS score is below 1% and the vulnerability is not in the CISA KEV catalog, indicating low known exploitation probability. Nevertheless, an attacker can trigger the flaw by introducing a malicious or malformed iSight device connected to the FireWire bus, which is often available to users on the same local network or within the same physical environment. Once the out-of-bounds write occurs, privilege escalation to root is possible, giving the attacker full control over the affected system.