What is CVE-2022-2652?

CVE-2022-2652 is a medium-severity vulnerability in Umlaeute Umlaeute/v4l2loopback, classified under Use of Externally-Controlled Format String. CVSS score: 6.0/10. Published 2022-08-04.

How severe is CVE-2022-2652?

Medium severity. CVSS v3 base score is 6.0 out of 10.

Vulnerability in Umlaeute Umlaeute/v4l2loopback

CVE-2022-2652

Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).

Published 2022-08-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H.

EPSS exploit prediction

EPSS: 0.003 (24.4th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 24.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Umlaeute Umlaeute/v4l2loopback — versions unspecified
V4l2loopback Project

Weakness classification (CWE)

CWE-134 — Use of Externally-Controlled Format String

References

huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5 (Exploit, Patch, Third Party Advisory, Issue Tracking)
github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2022-2652?: CVE-2022-2652 is a medium-severity vulnerability in Umlaeute Umlaeute/v4l2loopback, classified under Use of Externally-Controlled Format String. CVSS score: 6.0/10. Published 2022-08-04.
How severe is CVE-2022-2652?: Medium severity. CVSS v3 base score is 6.0 out of 10.