CVE-2026-1991: libuvc Null Pointer Dereference Vulnerability

CVE-2026-1991 Overview

A null pointer dereference vulnerability has been identified in libuvc, an open-source library for USB Video Class (UVC) devices, affecting versions up to and including 0.0.7. The vulnerability exists in the uvc_scan_streaming function within src/device.c, specifically in the UVC Descriptor Handler component. Successful exploitation allows a local attacker to cause a denial of service condition by triggering improper handling of UVC descriptors.

Critical Impact

Local attackers with low privileges can crash applications using libuvc by providing malformed UVC descriptors, leading to denial of service conditions affecting USB video streaming functionality.

Affected Products

• libuvc versions up to 0.0.7
• Applications and systems utilizing the libuvc library for USB video device handling
• Linux/Unix systems with UVC-enabled USB devices using the affected library versions

Discovery Timeline

• 2026-02-06 - CVE-2026-1991 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-1991

Vulnerability Analysis

This vulnerability is a null pointer dereference (CWE-404) that occurs during the parsing of UVC descriptors in the libuvc library. The uvc_scan_streaming function in src/device.c fails to properly validate descriptor data before dereferencing pointers, allowing an attacker to trigger a crash when the library processes specially crafted or malformed UVC descriptor data.

The vulnerability requires local access to exploit, meaning an attacker must have the ability to interact with the system's USB subsystem or provide malformed descriptor data through a connected device or crafted input. While the direct impact is limited to availability (denial of service), applications that rely on libuvc for video streaming could experience service interruptions.

A public exploit and reproduction case have been made available, and the vulnerability was reported to the libuvc project through GitHub Issue #300, though the project has not yet responded.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the UVC Descriptor Handler. The uvc_scan_streaming function processes descriptor data without adequately checking for null or invalid pointer conditions before attempting to access memory. When malformed descriptor data is encountered, the function attempts to dereference a null pointer, resulting in a crash.

This type of vulnerability commonly occurs when parsing complex data structures like USB descriptors, where edge cases involving malformed or incomplete data may not be properly handled.

Attack Vector

The attack requires local access to the system. An attacker could exploit this vulnerability by:

1. Connecting a malicious USB device that provides crafted UVC descriptors
2. Providing malformed descriptor data to an application using the libuvc library
3. Manipulating input data that gets processed by the uvc_scan_streaming function

The vulnerability in the uvc_scan_streaming function within src/device.c is triggered when processing UVC descriptors. When the function encounters malformed descriptor data, it fails to properly validate pointer values before dereferencing them, leading to a null pointer access. A reproduction case demonstrating this behavior is available in the GitHub Reproduction Case repository. Technical details can also be found in VulDB #344509.

Detection Methods for CVE-2026-1991

Indicators of Compromise

• Application crashes or unexpected terminations in processes using libuvc for USB video handling
• Segmentation fault signals (SIGSEGV) in system logs related to libuvc or UVC device operations
• Repeated service restarts for applications utilizing USB video functionality

Detection Strategies

• Monitor system logs for segmentation faults occurring in applications that utilize the libuvc library
• Implement application-level crash detection for services handling USB video devices
• Deploy SentinelOne agents configured to detect exploitation attempts targeting memory corruption vulnerabilities

Monitoring Recommendations

• Enable detailed logging for USB subsystem events to identify unusual device enumeration patterns
• Configure alerts for repeated application crashes in services using libuvc
• Monitor for unexpected USB device connections that may be attempting to provide malformed descriptors

How to Mitigate CVE-2026-1991

Immediate Actions Required

• Audit systems to identify applications using libuvc versions 0.0.7 and earlier
• Implement application sandboxing for services utilizing libuvc to limit the impact of potential crashes
• Consider restricting USB device access on critical systems until a patch is available

Patch Information

At the time of publication, no official patch has been released by the libuvc project. The vulnerability was reported through GitHub Issue #300, but the project maintainers have not yet responded. Users should monitor the libuvc GitHub repository for security updates and apply patches as soon as they become available.

Workarounds

• Restrict physical access to USB ports on sensitive systems to prevent malicious device connections
• Implement USB device whitelisting to only allow known and trusted devices
• Run applications using libuvc with minimal privileges to reduce the impact of potential crashes
• Consider using alternative UVC libraries or implementing additional input validation wrappers around libuvc functions

Implementing USB device access controls can help mitigate this vulnerability until an official patch is released:

# Configuration example
# Restrict USB device access using udev rules
# Create /etc/udev/rules.d/99-restrict-uvc.rules

# Deny access to unknown UVC devices by default
SUBSYSTEM=="usb", ATTR{bDeviceClass}=="0e", MODE="0000"

# Allow only specific trusted UVC devices (replace with your device IDs)
SUBSYSTEM=="usb", ATTR{idVendor}=="XXXX", ATTR{idProduct}=="YYYY", MODE="0660", GROUP="video"

# Reload udev rules
# sudo udevadm control --reload-rules
# sudo udevadm trigger