# CVE-2026-5265

> Vulnerability · severity: **MEDIUM** (CVSS 6.5).

## Description

When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

## Key facts

- **CVE ID:** CVE-2026-5265
- **Published:** 2026-04-24
- **CVSS severity:** MEDIUM
- **CVSS base score:** 6.5
- **CWE codes:** CWE-130

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-5265

## Citation

> AI Analytics. CVE-2026-5265. Retrieved 2026-07-15 from https://api.ai-analytics.org/cve/CVE-2026-5265. Derived from NIST NVD. Licensed CC0.

---

*[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*