EUVD-2026-89158
GHSA-qw48-47p6-3xv8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown access vector
-
ExploitUnknown vulnerability
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the description is empty and no product, feature, protocol, configuration, or deployment mode is identified. No CVSS vector is available to infer access or privilege prerequisites. Exploitation conditions are entirely unknown and must be sourced from the upstream NVD/Ubuntu advisory. |
| Impact | This entry is unassessable from the supplied data. There is no description ('[Unknown description]'), no CVSS score or vector, no CWE, no references, no EPSS score, no CISA KEV listing, and no POC indicator - the only intelligence is that it was reported by vendor:ubuntu. Because no CVSS vector is present, attack vector, complexity, and privilege requirements cannot be evaluated; because there is no EPSS/KEV/POC signal, exploitation likelihood cannot be gauged. No public exploit identified at time of analysis. This cannot be triaged as either a real priority or a low-real-risk item - every risk signal is missing. Note: CVE-2026-95319 sits numerically below a batch of Google Chrome stable-channel CVEs (CVE-2026-95344 through 95357) that share the identical 'vendor:ubuntu, no description' shape, but there is NO evidence tying 95319 to Chrome, and it must not be assumed to be a Chrome flaw. Action: retrieve the authoritative NVD/Ubuntu USN record before any prioritization decision. |
| Exploit ScenarioDerived | No exploit scenario can be constructed: the vulnerability class, affected product, and attack surface are all unknown from the provided data. No POC is referenced. Any scenario would be pure speculation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Ubuntu Linux is the only product attributable to CVE-2026-95319, and the sole intelligence signal available is a vendor:ubuntu report with no accompanying advisory text, version range, or affected component. No description, CVSS score, CVSS vector, CWE classification, CPE string, EPSS score, KEV status, or reference link was supplied, so the vulnerability class, attack vector, privilege requirements, and impact cannot be characterized. No public exploit code has been identified at time of analysis, but this reflects absent data rather than a confirmed absence of exploitation, and the entry must be treated as unassessable until the upstream NVD or Ubuntu security advisory is retrieved.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the absence of patch data is not confirmation that no fix exists. The immediate action is to retrieve the authoritative advisory by pulling the Ubuntu CVE tracker entry for CVE-2026-95319 and checking for a linked Ubuntu Security Notice, which will supply the affected package names, the Ubuntu releases in scope, and the exact fixed package versions to install via apt. In parallel, query NVD for the CVE record to obtain the CVSS vector and CWE, since the required compensating controls depend entirely on whether the flaw is remotely reachable, authentication-gated, or locally triggered, and choosing controls without that vector risks both over-blocking and under-protection. Because no attack surface, port, endpoint, or feature has been identified, no defensible configuration change, network restriction, or feature disablement can be recommended at this time; broad mitigations applied blindly could break production services without reducing actual exposure. Until the advisory lands, treat the identifier as unprioritized rather than non-urgent, and monitor the Ubuntu security tracker feed so that patching begins the moment a fixed package version is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The only structured datum in this record is the attribution 'Reported by: vendor:ubuntu', which indicates the CVE is tracked against one or more packages maintained in the Ubuntu archive and that Canonical is the coordinating vendor for advisories and patched package versions. There is no CWE to identify the root-cause class (for example memory-safety, injection, deserialization, or logic error), no CVSS vector to establish whether exploitation requires network access, adjacent access, or local access, and no CPE string to pin the affected product line, package name, or version window. Because the description field is empty, it is impossible to determine whether the flaw sits in Ubuntu's own tooling, in a Debian-inherited package, or in upstream third-party software that Ubuntu merely redistributes, and each of those cases implies a materially different analysis and disclosure timeline. Any technical characterization at this stage would be speculation, so the underlying library, protocol, or subsystem involved must be derived from the authoritative Ubuntu CVE tracker entry and the corresponding NVD record once they are available.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB