Junglewise Threat Intelligence

CVE-2026-5265: Red Hat OVN heap over-read in ICMP error response generation

CVE-2026-5265 · Severity: medium · CVSS 6.5 · Published 2026-04-24

Vendors: Red Hat.

Executive brief

A vulnerability in the Open Virtual Network (OVN) software could allow an attacker to view sensitive information from the system's memory. By sending specially crafted network packets that trigger error messages, a malicious virtual machine can trick the system into including extra data from its internal memory in its response. This could lead to the exposure of private data or cause service instability.

Technical details

A heap over-read vulnerability exists in the ovn-controller component of OVN when generating ICMP 'Destination Unreachable' or 'Packet Too Big' responses. The handler uses the self-declared length field from the IP header (ip_tot_len for IPv4 or ip6_plen for IPv6) to copy data into the ICMP error body without validating it against the actual buffer size. An attacker within a virtual machine can send a short packet with an inflated length field that triggers an ICMP error (such as hitting a 'reject' ACL), causing the controller to read beyond the packet buffer and leak heap memory back to the VM. This is classified as CWE-130 (Improper Handling of Length Parameter Inconsistency).

Affected products

  • Red Hat OVN (Open Virtual Network) 2021, 23.06, 23.09, 24.03

Timeline

  • 2026-04-20: disclosed: Initial disclosure on oss-security mailing list
  • 2026-04-24: advisory: NVD publication date
  • 2026-04-29: patched: Red Hat released security updates (RHSA-2026:11694, RHSA-2026:11695, etc.)

References