What is the CVSS score of CVE-2025-52992?

CVE-2025-52992 has a CVSS 3.1 base score of 3.2 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2025-52992?

CVE-2025-52992 is a low-severity vulnerability involving incorrect permissions (CVSS 3.2).. A patch is available.

How to fix or mitigate CVE-2025-52992?

During next maintenance window: Apply vendor patches when convenient. Verify incorrect permissions controls are in place.

Ubuntu CVE-2025-52992

EUVD-2025-19380 LOW

Incorrect Permission Assignment for Critical Resource (CWE-732)

2025-06-27 cve@mitre.org

Information Disclosure Ubuntu Debian

3.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.2 LOW

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19380

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 14:15 nvd

LOW 3.2

DescriptionCVE.org

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Analysis

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment for Critical Resource (CWE-732).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all

CVE-2017-9462 HIGH POC

8.8

CVE-2017-3006 HIGH POC

8.8

CVE-2017-9602 CRITICAL POC

9.8

CVE-2022-22960 HIGH POC

7.8

CVE-2021-38085 HIGH POC

7.8

CVE-2021-35449 HIGH POC

7.8

CVE-2020-11855 HIGH POC

7.8

CVE-2020-10883 HIGH POC

7.8

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

Vendor StatusVendor

Ubuntu

Priority: Medium

guix

Release	Status	Version
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
plucky	ignored	end of life, was needs-triage
oracular	ignored	end of life, was needs-triage
questing	DNE	-

Debian

Bug #1108318

guix

Release	Status	Fixed Version	Urgency
bullseye	fixed	(unfixed)	end-of-life
bullseye (security)	vulnerable	1.2.0-4+deb11u3	-
sid	vulnerable	1.4.0-9	-
(unstable)	fixed	(unfixed)	-

CVE-2025-52992 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-52992

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

Same technique Information Disclosure

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code