What is the CVSS score of CVE-2025-9640?

CVE-2025-9640 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Samba CVE-2025-9640

MEDIUM

Use of Uninitialized Resource (CWE-908)

N/A vendor:alpine

Information Disclosure

4.3

CVSS 3.1 · Vendor: vendor:alpine

Severity by source

Vendor (vendor:alpine) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (vendor:alpine) · only source for this CVE.

CVSS VectorVendor: vendor:alpine

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 25, 2026 - 08:22 NVD

4.3 (MEDIUM)

Analysis Generated

May 27, 2026 - 23:06 vuln.today

DescriptionCVE.org

Alpine Linux: samba fixed in 4.21.9-r0

AnalysisAI

Samba on Alpine Linux was patched in package version 4.21.9-r0, addressing an unspecified vulnerability reported by the Alpine Linux vendor. The nature of the underlying flaw - whether it involves remote code execution, privilege escalation, information disclosure, or another class of impact - is not determinable from the available data. EPSS scores this at 0.08% (24th percentile), indicating low observed exploitation probability at time of analysis, and no public exploit or CISA KEV listing has been identified.

Technical ContextAI

Samba is the open-source implementation of the SMB/CIFS networking protocol, widely used to provide file and print services interoperability between Linux/Unix and Windows systems. It encompasses components including smbd (file/print services), nmbd (NetBIOS name service), and winbindd (domain authentication). Alpine Linux packages Samba as a musl-libc-based binary, and the package versioning scheme '4.21.9-r0' indicates the upstream Samba version is 4.21.9 with Alpine revision 0. No CWE classification was provided, so the root cause class - whether a memory corruption issue, logic error, authentication bypass, improper input validation, or other - cannot be confirmed from available data.

Affected ProductsAI

Alpine Linux systems running Samba packages prior to version 4.21.9-r0 are confirmed affected per the Alpine Linux vendor report. The upstream Samba version corresponding to this fix is 4.21.9. Specific Alpine Linux release branches (e.g., edge, v3.21, v3.20) where this package version applies have not been specified in the available data. No CPE strings were provided in the source intelligence. Users should consult the Alpine Linux security tracker and the Alpine package changelog for the samba package to identify which Alpine release branches received this fix.

RemediationAI

Upgrade the Samba package on Alpine Linux to version 4.21.9-r0 or later using the Alpine package manager: 'apk update && apk upgrade samba'. This is the vendor-confirmed fix per the Alpine Linux security report. Because the underlying vulnerability details are not disclosed in available data, targeted workarounds cannot be responsibly prescribed. General compensating controls pending patching include restricting SMB port access (TCP 445, TCP/UDP 137-139) at the network perimeter to only trusted hosts, disabling Samba services entirely if file sharing is not required, and auditing Samba share permissions to enforce least privilege. Note that restricting port access does not mitigate vulnerabilities exploitable by already-authenticated or local users. No upstream Samba advisory URL was included in the source data - consult https://www.samba.org/samba/security/ for the corresponding upstream advisory.