EUVD-2026-89132
GHSA-365g-qr8c-6v6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown access vector
-
ExploitUnknown vulnerability
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the description provides no product feature, protocol, configuration setting, deployment mode, authentication level, or user-interaction requirement. No CVSS vector is available to infer attack vector or privileges. Exploitation prerequisites are entirely unknown pending vendor/NVD enrichment. |
| Impact | This is a data-void entry with no analyzable signals. The description is '[Unknown description]', CVSS score and vector are N/A, and CWE is N/A. There is no EPSS score, no CISA KEV listing, and no evidence of public exploit code. The only intelligence available is the reporting attribution 'vendor:ubuntu', which indicates the CVE was surfaced through Ubuntu's tracking pipeline but says nothing about the affected product, vulnerability class, or severity. Consequently NO real-world risk determination can be made from the provided data - neither exploitability nor impact can be characterized. This CVE ID (CVE-2026-95325) sits in the numeric gap BELOW a confirmed batch of Google Chrome desktop CVEs (CVE-2026-95344 through CVE-2026-95357), but proximity is not evidence: it is NOT confirmably Chrome and the product must be treated as UNKNOWN. Any priority scoring should be deferred until NVD/vendor enrichment supplies a description and CVSS vector; treat this as un-triageable rather than either high or low risk. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability description, affected product, and attack vector are all unknown. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
The affected product and the nature of the security impact for CVE-2026-95325 cannot be established from the intelligence available at time of analysis. The only signal present is that the entry was reported by the vendor source 'ubuntu', with no description, CVSS score or vector, CWE mapping, CPE identifiers, references, EPSS score, or KEV status supplied; the independent assessment accordingly classifies this as a data-void entry with no analyzable signals. No public exploit identified at time of analysis, and there is no basis to characterize the attack vector, authentication requirements, or affected versions.
RemediationAI
No vendor-released patch identified at time of analysis, because no fix version, advisory URL, or patch reference was included in the available data - this reflects absent data, not a vendor confirmation that no fix exists. The actionable step is to monitor the Ubuntu CVE tracker entry for CVE-2026-95325 and the Ubuntu Security Notices feed (ubuntu.com/security/notices) for a USN that will name the affected source packages and the fixed version per Ubuntu release; also re-check NVD for CPE and CVSS enrichment. Once the package is identified, the standard Ubuntu remediation path is to update only that package with 'apt-get update && apt-get install --only-upgrade <package>' (or 'apt-get upgrade') and then verify the running version, since broad upgrades of an as-yet-unidentified component carry unnecessary change risk. If the component turns out to require a service restart or a reboot for a kernel change, schedule it accordingly, as live patching will not cover an unclassified issue. Do not apply speculative mitigations such as disabling services, blocking ports, or tightening AppArmor or firewall rules against an unknown target: without a confirmed affected component those changes impose availability and operational cost with no demonstrable reduction in risk. If this CVE later becomes subject to active exploitation or a public proof of concept, prioritize the vendor patch over any compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
No technical root-cause context can be derived for CVE-2026-95325. The record lacks a CWE mapping, so the underlying weakness class (for example injection, memory-safety, access-control, or cryptographic failure) is unknown, and it lacks CPE data, so the specific package, library, kernel subsystem, or Ubuntu release branch involved cannot be identified. The absence of a CVSS vector means attack vector, attack complexity, privileges required, and user-interaction requirements are all unconfirmed; the independent assessment explicitly states that exploitation conditions cannot be determined because the description provides no product feature, protocol, configuration setting, deployment mode, authentication level, or user-interaction detail. The single provenance signal is the reporter field 'vendor:ubuntu', which indicates the record originated from Ubuntu's vulnerability reporting or disclosure channel (most likely the Ubuntu CVE tracker or an Ubuntu Security Notice workflow) rather than an independent third-party analysis, but this identifies only the coordinating vendor, not the vulnerable component.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB