CVE-2022-32166: Cloudbase Open Vswitch

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

Affected products

• Cloudbase Open Vswitch: from 0.90.0, up to and including 2.5.0
• Debian Debian Linux: version 10.0 only

Published 2022-09-28. Last modified 2026-06-17.