Canonical Apport CVE-2025-5467

Exploitation requires an existing local, low-privileged account on an affected Ubuntu/Apport host (AV:L, PR:L) and depends on Apport's process_crash() routine actually generating a crash report; the attacker-readable exposure only occurs for crash files written with the incorrect group ownership. Limiting factors: no remote vector, authentication/local access is mandatory (PR:L), no user interaction of a victim is needed but the attacker must belong to the unintended group that gains access, and impact is confined to reading crash-report contents (confidentiality only) - there is no code execution, modification, or service disruption.

All signals converge on LOW real-world priority. The input CVSS 4.0 base score is 1.9 with vector AV:L/AC:L/PR:L/UI:N and only a low confidentiality impact (VC:L, VI:N, VA:N), meaning a local, already-authenticated low-privileged user can at most read crash data that was mis-grouped - no integrity or availability impact and no remote exposure. EPSS reinforces this: 0.18% probability at the 7th percentile indicates negligible expected exploitation. The CVE is NOT on CISA KEV, so there is no evidence of active exploitation; publicly available exploit code exists (per the Launchpad/Stratascale references), but POC availability is a distinct signal from in-the-wild use and does not elevate urgency here given the local-only, authenticated, low-impact profile. The 'E:P' (Proof-of-Concept) exploit-maturity metric in the supplied 4.0 vector is consistent with that POC signal. One conflict worth flagging: the input Tags include 'Denial Of Service,' but the CVSS vector and CWE-708 (Incorrect Ownership) describe an information-disclosure/confidentiality issue (VC:L with VA:N) - the DoS label is inconsistent with the stated impact and should not drive triage.

On a multi-user Ubuntu system, an application crashes and Apport's process_crash() writes the resulting crash report with an incorrect group owner. A local, unprivileged user who happens to be in that unintended group can then read the crash file, which may contain memory contents, environment data, or paths from another user's or service's process. Public proof-of-concept material is referenced on Launchpad, but exploitation remains local and requires an existing account.