What is the CVSS score of EUVD-2025-19410?

EUVD-2025-19410 has a CVSS 3.1 base score of 2.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by EUVD-2025-19410?

CVE-2025-46416 is a low-severity vulnerability (CVSS 2.9). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate EUVD-2025-19410?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Ubuntu EUVD-2025-19410

| CVE-2025-46416 LOW

Improper Ownership Management (CWE-282)

2025-06-27 cve@mitre.org

Authentication Bypass Debian Ubuntu

2.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19410

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 14:15 nvd

LOW 2.9

DescriptionCVE.org

The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

AnalysisAI

A privilege escalation vulnerability (CVSS 2.9) that allows a bypass of build isolation. Remediation should follow standard vulnerability management procedures.

Technical ContextAI

Vulnerability type: privilege escalation.

RemediationAI

Monitor vendor channels for patch availability.

Same weakness CWE-282 – Improper Ownership Management

View all

CVE-2023-0386 HIGH POC

7.8

CVE-2024-39755 HIGH POC

7.8

CVE-2023-7226 MEDIUM POC

6.3

CVE-2025-32946 MEDIUM POC

5.3

CVE-2024-3383 CRITICAL

9.1

CVE-2026-50130 HIGH

8.8

CVE-2026-23514 HIGH

8.8

CVE-2024-37999 HIGH

8.5

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

Ubuntu

Priority: Medium

guix

Release	Status	Version
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
plucky	ignored	end of life, was needs-triage
questing	DNE	-

Debian

Bug #1108318

guix

Release	Status	Fixed Version	Urgency
bullseye	fixed	(unfixed)	end-of-life
bullseye (security)	vulnerable	1.2.0-4+deb11u3	-
sid	vulnerable	1.4.0-9	-
(unstable)	fixed	(unfixed)	-

EUVD-2025-19410 vulnerability details – vuln.today

Back

Ubuntu EUVD-2025-19410

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-282 – Improper Ownership Management

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code