What is the CVSS score of CVE-2025-5745?

CVE-2025-5745 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2025-5745?

Organizations using the GNU C Library should be aware of moderate risk from CVE-2025-5745 rated CVSS 5.6. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-5745?

Within 30 days: Identify affected systems running the GNU C Library and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ubuntu CVE-2025-5745

EUVD-2025-17018 MEDIUM

Improper Initialization (CWE-665)

2025-06-05 3ff69d7a-14f2-4f67-a097-88dee7810d18

Information Disclosure Debian Ubuntu Red Hat Glibc Suse

5.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 17:53 euvd

EUVD-2025-17018

Analysis Generated

Mar 14, 2026 - 17:53 vuln.today

CVE Published

Jun 05, 2025 - 20:15 nvd

MEDIUM 5.6

DescriptionNVD

The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

AnalysisAI

A security vulnerability in the GNU C Library (CVSS 5.6). Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type not specified by vendor. Affects the GNU C Library.

RemediationAI

Monitor vendor channels for patch availability.

More from same product – last 7 days

CVE-2026-9277 HIGH This Week

8.1 May 22

Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr

CVE-2026-9256 HIGH This Week

8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

CVE-2026-47269 HIGH This Week

7.4 May 27

Authentication-context bypass in pam_usb before 0.9.0 lets a person holding an enrolled USB device authenticate over SSH

CVE-2026-47271 MEDIUM This Month

5.1 May 27

pam_usb prior to 0.9.0 crashes under memory pressure due to assert()-based OOM guards in src/mem.c that are silently str

CVE-2026-45898 Awaiting Data

May 27

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removin

Vendor StatusVendor

Ubuntu

Priority: Medium

glibc

Release	Status	Version
xenial	not-affected	code not present
bionic	not-affected	code not present
focal	not-affected	code not present
jammy	not-affected	code not present
noble	not-affected	code not present
upstream	needs-triage	-
plucky	released	2.41-6ubuntu1.1
oracular	ignored	end of life, was needed

eglibc

Release	Status	Version
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
plucky	DNE	-
upstream	needs-triage	-
trusty	not-affected	code not present

USN-7634-1

Debian

Bug #1107366