Vulnerability record/PUBLISHED/Published Oct 15, 2025 12:47:29 UTC
CVE-2025-9640
A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.
Base score4.3/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 6, 2026 17:47:22 UTC
PublishedOct 15, 2025 12:47:29 UTC
ReservedAug 29, 2025 03:11:20 UTC