CVE-2026-5265
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:HSummary
CVE-2026-5265 is a medium-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25420
Vulnerability Data
When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating…
more
it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds heap read in ovn-controller ICMP handler allows a VM to directly obtain arbitrary memory contents from the local system via crafted packets and returned error responses.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of length fields (ip_tot_len/ip6_plen) against actual received buffer size before copying into ICMP responses.
Enforces boundary checks and filtering on traffic entering from untrusted VMs, preventing malformed packets from reaching the vulnerable ICMP handler.
Enables monitoring and anomaly detection on packet processing paths to identify length-inconsistency attempts that trigger out-of-bounds reads.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce length validation and input sanitization during coding and review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect length-inconsistency vulnerabilities before deployment.
Secure development lifecycle mandates input validation and length checks that directly address inconsistent length fields.
Application security requirements include explicit rules for handling message lengths and data structures.
Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
Secure coding standards directly prohibit improper length handling and enforce defensive parsing practices.