CVE-2026-1991: 
NixOS vulnerability analysis and mitigation

CVE-2026-1991 is a NULL pointer dereference vulnerability in libuvc, a cross-platform library for USB video devices, affecting all versions up to and including 0.0.7. The flaw resides in the uvc_scan_streaming function within src/device.c of the UVC Descriptor Handler component. It was reported via a GitHub issue on January 4, 2026, and publicly disclosed on February 6, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) combined with improper resource shutdown or release (CWE-404) in the uvc_scan_streaming function at src/device.c:1332. When processing a malformed UVC descriptor, the function — called by uvc_parse_vc_header — fails to validate a pointer to a descriptor block or interface info structure before dereferencing it, resulting in a READ access violation at address 0x000000000010. The vulnerability was discovered through fuzzing with AddressSanitizer (ASAN), which reported a SEGV signal. A public proof-of-concept reproducer (a 16-byte malformed input file) is available on GitHub (libuvc Issue #300, PoC Repro).

Successful exploitation causes the application using libuvc to crash, resulting in a denial of service (DoS) condition. The impact is limited to availability — there is no confidentiality or integrity compromise, as the vulnerability only triggers an application crash rather than enabling code execution or data exfiltration. Systems or embedded devices (e.g., webcam drivers, robotics, IoT) relying on libuvc for USB video device handling are at risk of service disruption (Red Hat Advisory, libuvc Issue #300).

A public proof-of-concept exploit (a malformed UVC descriptor input) is available on GitHub and referenced on VulDB, making exploitation straightforward for local attackers with low privileges (libuvc Issue #300, VulDB). Exploitation requires local access and low-level privileges, with no user interaction needed. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013% (very low probability of exploitation in the near term) (Red Hat Advisory).

1. Reconnaissance: Identify systems running applications that use libuvc version 0.0.7 or earlier for USB video device handling (e.g., webcam software, robotics frameworks, IoT devices on Linux).
2. Obtain PoC: Download the publicly available 16-byte malformed UVC descriptor reproducer from the GitHub repository at https://github.com/oneafter/0104/blob/main/repro.
3. Compile the target: Build the libuvc test harness with AddressSanitizer enabled (clang -fsanitize=address -g) or use a standard build to trigger the crash without ASAN.
4. Trigger the vulnerability: Feed the malformed descriptor to the libuvc harness or any application that processes UVC descriptors via uvc_scan_streaming: ./harness < repro.
5. Achieve DoS: The malformed descriptor causes uvc_scan_streaming at src/device.c:1332 to dereference a NULL pointer, resulting in a segmentation fault (SIGSEGV) and application crash, denying service to legitimate users (libuvc Issue #300, PoC Repro).

• Logs: Application crash logs or core dumps referencing uvc_scan_streaming in src/device.c:1332; ASAN output showing SEGV on unknown address 0x000000000010 with stack trace pointing to uvc_scan_streaming → uvc_parse_vc_header.
• Process: Unexpected termination of processes using libuvc (e.g., webcam daemons, UVC device managers) with signal SIGSEGV (signal 11).
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory of the affected application following a crash.
• System: Repeated application restarts or watchdog-triggered restarts of services relying on libuvc for USB video device access (libuvc Issue #300).

Upgrade libuvc to a version released after 0.0.7, which addresses this vulnerability; a patch was noted as available as of March 5, 2026 (Red Hat Bugzilla). As a workaround, restrict local user privileges on systems running libuvc-based applications to reduce the attack surface, and avoid processing untrusted or externally supplied UVC descriptors. Organizations should monitor the libuvc GitHub repository for an official patched release and apply it promptly.

Red Hat tracked the vulnerability via its Product Security team and opened a Bugzilla entry (Bug 2437262) with medium priority and severity, indicating it is under review but not yet resolved in Red Hat products (Red Hat Bugzilla). The libuvc project maintainers had not responded to the issue report as of the disclosure date. Tenable added detection for this vulnerability via Nessus plugin 298196 (Tenable). No significant broader media coverage or notable researcher commentary beyond the initial issue report has been observed.