Buffer Overflow Vulnerability in Apple iSight for FireWire by Linux Kernel

CVE-2026-64483

What is CVE-2026-64483?

A buffer overflow vulnerability exists within the ALSA firewire driver in the Linux kernel affecting Apple iSight devices. The vulnerability arises when the function isight_packet() erroneously allows a sample count that exceeds the permissible payload size, which can lead to unexpected memory access. Specifically, it checks the sample count against the device's claimed ISO packet length but fails to adequately restrict this count based on MAX_FRAMES_PER_PACKET, resulting in potential read and write operations beyond allocated memory. By capping the count to MAX_FRAMES_PER_PACKET, the risk of reading from and writing to out-of-bounds memory is mitigated, thus enhancing device security during normal captures.

References