What is the CVSS score of CVE-2025-46415?

CVE-2025-46415 has a CVSS 3.1 base score of 3.2 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2025-46415?

CVE-2025-46415 is a low-severity vulnerability (CVSS 3.2). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2025-46415?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Ubuntu CVE-2025-46415

EUVD-2025-19426 LOW

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2025-06-27 cve@mitre.org

Information Disclosure Ubuntu Debian

3.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.2 LOW

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19426

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 14:15 nvd

LOW 3.2

DescriptionCVE.org

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Analysis

Technical ContextAI

A race condition occurs when the behavior of software depends on the timing of events, such as the order of execution of threads or processes.

RemediationAI

Use proper synchronization mechanisms (locks, mutexes, atomic operations). Implement file locking for filesystem operations. Avoid TOCTOU patterns.

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all

CVE-2024-30088 HIGH POC

7.0

CVE-2025-22224 CRITICAL

9.3

CVE-2022-48618 HIGH

7.0

CVE-2023-38146 HIGH POC

8.8

CVE-2025-34027 CRITICAL POC

10.0

CVE-2020-1337 HIGH POC

7.8

CVE-2026-25641 CRITICAL POC

10.0

CVE-2024-28718 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

Ubuntu

Priority: Medium

guix

Release	Status	Version
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
plucky	ignored	end of life, was needs-triage
questing	DNE	-

Debian

Bug #1108318

guix

Release	Status	Fixed Version	Urgency
bullseye	fixed	(unfixed)	end-of-life
bullseye (security)	vulnerable	1.2.0-4+deb11u3	-
sid	vulnerable	1.4.0-9	-
(unstable)	fixed	(unfixed)	-

CVE-2025-46415 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-46415

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code