CVE-2008-3496: Critical – Buffer overflow in format descriptor parsing in the uvc_parse_format

This vulnerability was disclosed in 2008. A critical vulnerability affects Linux systems (CVE-2008-3496). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2008-GLOBAL-328579-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2008-3496?

This vulnerability was disclosed in 2008. A critical vulnerability affects Linux systems (CVE-2008-3496). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

What is the CVSS score for CVE-2008-3496?

CVE-2008-3496 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 3.3%.

Is CVE-2008-3496 actively exploited?

No confirmed active exploitation of CVE-2008-3496 as of 2026-09-25.

How do I remediate CVE-2008-3496?

Priority: MEDIUM. PSIRT: [email protected]

What systems are affected by CVE-2008-3496?

CVE-2008-3496 affects Linux Linux Kernel.

Vulnerability Details

CVE ID	`CVE-2008-3496`
BSID	`BS-2008-GLOBAL-328579-C` BreachSpider Global ID
CVSS Vector	`AV:N/AC:L/Au:N/C:C/I:C/A:C`
Published	2008-08-06
Last Modified	2026-06-16
ICS Relevance	15%
Weakness (CWE)	Buffer Copy without Checking Size (Classic Buffer Overflow)
Source	NVD

Official Description

Buffer overflow in format descriptor parsing in the uvc_parse_format function in drivers/media/video/uvc/uvc_driver.c in uvcvideo in the video4linux (V4L) implementation in the Linux kernel before 2.6.26.1 has unknown impact and attack vectors.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: Buffer overflow in format descriptor parsing in the uvc_parse_format function in drivers/media/video/uvc/uvc_driver.c in uvcvideo in the video4linux (V4L) implementation in the Linux kernel before 2.6.26.1 has unknown impact and attack vectors. CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.

Exploitation Likelihood: LOW

Affected Products

Vendor	Product	Affected Versions
Linux	Linux Kernel	`< 2.6.26.1`

Remediation

No official vendor advisory link on record. See the CVE record →

Vendor PSIRT: [email protected]

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 6644 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`2c5252e10509e0a5b5540b43c50b3fe6b6030fe486d0e1584d868959dbcb01cc667ccef5c977b995aebd117bc80dbe5ef37d18f1e2d0f95441a6824cfc61e1c9`

Related CVEs affecting Linux

CVE-2026-48331 10.0 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SS... CVE-2015-5124 10.0 Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 ... CVE-2015-3133 10.0 Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 ... CVE-2026-47938 10.0 Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affect... CVE-1999-0698 10.0 Denial of service in IP protocol logger (ippl) on Red Hat and Debian Linux.

View all Linux CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →