CVE-2024-53104
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.034 · 89 %ileexploit · PoCDEEUNLRUUSadded 2025-02-05remediate by 2025-02-26
required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS · scored 2026-10-26
Linux Kernel Out-of-Bounds Write Vulnerability
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
ATT&CK techniques
ATT&CK techniques this enables or maps to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (81)
Products and version ranges known to be affected.
advisories (6)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0039Kwetsbaarheden verholpen in Google Android en Samsung MobileNL2025-02-04csaf · ncsc_nlNL
Google heeft kwetsbaarheden verholpen in Android. In deze update zijn ook updates meegenomen voor closed-source componenten van Qualcomm, Imagination Technologies, Unisoc en MediaTek. Samsung heeft kwetsbaarheden in Samsung Mobile verholpen die relevant zijn voor Samsung mobile devices.
- SSA-355557SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.22025-08-12csaf · siemens_psirtDE
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2024-3570Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-12-01csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2025-0251Google Android: Mehrere SchwachstellenDeutsch2025-02-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen,, um seine Privilegien zu erweitern, einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.
- ICSA-25-226-07Siemens Third-Party Components in SINEC OS2025-08-12icsa · cisa_csaf_otUS
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- ASB-A-3784553922025-02-01vendor · osvUS
In uvc_parse_format of uvc_driver.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (30)
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/1ee9d9122801eb688783acd07791f2906b87cb4fcnnvd
- https://git.kernel.org/stable/c/467d84dc78c9abf6b217ada22b3fdba336262e29cnnvd
- https://git.kernel.org/stable/c/575a562f7a3ec2d54ff77ab6810e3fbceef2a91dcnnvd
- https://git.kernel.org/stable/c/622ad10aae5f5e03b7927ea95f7f32812f692bb5cnnvd
- https://git.kernel.org/stable/c/684022f81f128338fe3587ec967459669a1204aecnnvd
- https://git.kernel.org/stable/c/95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8cnnvd
- https://git.kernel.org/stable/c/beced2cb09b58c1243733f374c560a55382003d6cnnvd
- https://git.kernel.org/stable/c/ecf2b43018da9579842c774b7f35dbe11b5c38ddcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan