CVE-2022-2652
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
- Record
CVE-2022-2652- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-134
- Updated
- 2026-11-02
EUVDEUVD-2022-34898
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
- Record
EUVD-2022-34898- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-grx9-955g-vjfg
Depending on the way the format strings in the card label are crafted it's possible to leak...
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
- Record
GHSA-grx9-955g-vjfg- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-134
- Updated
- 2026-11-02
NVD
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
- Record
CVE-2022-2652- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-134
- Updated
- 2026-11-02
OSV
Use of Externally-Controlled Format String in umlaeute/v4l2loopback
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
- Record
CVE-2022-2652- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L - Weakness
- CWE-134
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-2652
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
- Record
DEBIAN-CVE-2022-2652- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
Show 4 moreShow less
OSVUBUNTU-CVE-2022-2652
Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
- Record
UBUNTU-CVE-2022-2652- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10159-1 No score
Security update for v4l2loopback
This update for v4l2loopback fixes the following issues:
- Fix string format vulnerability (boo#1202156, CVE-2022-2652)
- Record
openSUSE-SU-2022:10159-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10160-1 No score
Security update for v4l2loopback
This update for v4l2loopback fixes the following issues:
- Fix string format vulnerability (boo#1202156, CVE-2022-2652)
- Record
openSUSE-SU-2022:10160-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12372-1 No score
v4l2loopback-autoload-0.12.7-1.1 on GA media
These are all security issues fixed in the v4l2loopback-autoload-0.12.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12372-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
v4l2loopbackDebian:12 |
before 0.12.7-1 | 0.12.7-1 |
v4l2loopbackDebian:13 |
before 0.12.7-1 | 0.12.7-1 |
v4l2loopbackDebian:14 |
before 0.12.7-1 | 0.12.7-1 |
v4l2loopbackUbuntu:16.04:LTS |
All versions, plus listed versions 0.8.0-4ubuntu20.9.1-40.9.1-4ubuntu0.1 |
None known |
v4l2loopbackUbuntu:18.04:LTS |
All versions, plus listed versions 0.10.0-10.10.0-1ubuntu10.10.0-1ubuntu1.10.10.0-1ubuntu1.2 |
None known |
v4l2loopbackUbuntu:20.04:LTS |
All versions, plus listed versions 0.12.2-10.12.3-10.12.3-1ubuntu0.10.12.3-1ubuntu0.20.12.3-1ubuntu0.30.12.3-1ubuntu0.4 |
None known |
v4l2loopbackUbuntu:22.04:LTS |
All versions, plus listed versions 0.12.5-1ubuntu30.12.5-1ubuntu40.12.5-1ubuntu50.12.7-2ubuntu2~22.04.1 |
None known |
v4l2loopbackUbuntu:24.04:LTS |
All versions, plus listed versions 0.12.7-2ubuntu40.12.7-2ubuntu50.12.7-2ubuntu5.10.12.7-2ubuntu5.2 |
None known |
v4l2loopbackUbuntu:25.10 |
All versions, plus listed versions 0.13.2-1ubuntu10.15.0-0ubuntu10.15.0-0ubuntu20.15.0-0ubuntu2.1 |
None known |
v4l2loopbackUbuntu:26.10 |
All versions, plus listed versions 0.15.3-1ubuntu2 |
None known |
v4l2loopbackUbuntu:26.04:LTS |
All versions, plus listed versions 0.15.0-0ubuntu20.15.3-1ubuntu10.15.3-1ubuntu2 |
None known |
v4l2loopbackopenSUSE:Leap 15.4 |
before 0.12.5-lp154.3.3.1 | 0.12.5-lp154.3.3.1 |
v4l2loopbackopenSUSE:Leap 15.3 |
before 0.12.5-lp153.2.5.1 | 0.12.5-lp153.2.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2652 is a high vulnerability (CVSS 7.3) in Umlaeute Umlaeute/v4l2loopback, published August 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in v4l2loopback 0.12.7-1.
References
huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5
github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd
nvd.nist.gov/vuln/detail/CVE-2022-2652
security-tracker.debian.org/tracker/CVE-2022-2652
Show 6 moreShow less
ubuntu.com/security/CVE-2022-2652
cve.org/CVERecord?id=CVE-2022-2652
lists.opensuse.org/archives/list/[email protected]/thread/F2WY45Y5MOK5BLB5QRH5F6TM4CWLBTL5
bugzilla.suse.com/1202156
suse.com/security/cve/CVE-2022-2652