What is the CVSS score of EUVD-2025-211004?

EUVD-2025-211004 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2025-211004?

Yes, a patch is available for EUVD-2025-211004. Update the affected software to the latest version immediately.

Ubuntu Linux EUVD-2025-211004

| CVE-2025-14181 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-09-24 vendor:ubuntu

Information Disclosure Integer Overflow

6.5

CVSS 3.1 · Vendor: vendor:ubuntu

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Insufficient data
Exploit

Affected component unknown
Impact

Impact undetermined

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation prerequisites cannot be determined. The description is absent and no CVSS vector is provided, so required privileges, user interaction, attack vector (network vs. local), and any configuration or feature-dependent conditions are all unknown. Authentication requirements are not confirmed from available data. This must be resolved by consulting the Ubuntu advisory and NVD entry before defenders can assess realistic exposure.
Impact	Risk cannot be meaningfully assessed from the available data. No CVSS 3.1 or 4.0 vector, no CWE, no description, no EPSS score, no KEV listing, no POC reference, and no SSVC decision inputs were provided - the only signal is that the entry is attributed to the Ubuntu vendor source, which suggests it may relate to a package tracked in the Ubuntu ecosystem but does not by itself indicate affected component, attack vector, or impact. With no exploitation-probability signal (EPSS absent), no active-exploitation confirmation (not in CISA KEV), and no public exploit reference, there is no basis to rate this as either a priority or a low-real-risk issue. This is a genuine data-completeness gap, not a low-severity finding: all key scoring signals are MISSING and must be obtained from the authoritative source (Ubuntu Security Notices / NVD) before any prioritization decision. Do NOT treat the absence of signals as evidence of low risk.
Exploit ScenarioDerived	No exploit scenario can be constructed because the vulnerability description, affected product, and attack vector are all unavailable. No public exploit code is referenced in the provided data. Any scenario stated here would be speculation unsupported by the input.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

CVE-2025-14181 currently has no usable detail: the record contains no description, no CVSS score, no CVSS vector, and no CWE, and the only supplied attribution is the vendor source "ubuntu". Because the affected component, the impact class, and the attack vector are all undefined, it is not possible to state who is affected beyond the Ubuntu distribution packaging channel, nor what an attacker could achieve; authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis and no CISA KEV entry is present. Risk cannot be meaningfully assessed from the available data, so this identifier should be triaged as unresolved rather than as a confirmed threat until the Ubuntu security advisory and NVD entry are populated.

RemediationAI

No vendor-released patch identified at time of analysis, and no fix version can be cited because the input contains no patch data, no reference URLs, and no affected-package information. The primary action is therefore verification rather than remediation: retrieve the Ubuntu security advisory from the Ubuntu CVE tracker (ubuntu.com/security/CVE-2025-14181) and the NVD record (nvd.nist.gov/vuln/detail/CVE-2025-14181), and subscribe to Ubuntu Security Notices so the affected package set and fixed version are captured as soon as they are published. In the interim, actionable steps are bounded by the missing scope: enumerate Ubuntu hosts and record installed package versions so that a targeted patch can be applied quickly once the advisory identifies the component, ensure unattended-upgrades or equivalent patch automation is enabled with a known reboot/patch window so security updates apply without manual delay, and if the eventual advisory identifies a network-reachable service, temporarily restrict that service to trusted management networks or disable it where non-essential, accepting the resulting loss of functionality and the risk of breaking dependent workflows as the trade-off. Do not apply speculative package holds or blanket feature disables, since without a known component they would impose operational cost without reducing a quantified risk. Re-assess risk in full once the description, CWE, and CVSS vector become available.

Affected VersionsENISA

PHP 8.4.* <8.4.26

PHP 8.3.* <8.3.35

PHP 8.2.* <8.2.34

PHP 8.5.* <8.5.11

Affected Packages

euvd php_8_2 fix: 8.2.34

euvd php_8_3 fix: 8.3.35

euvd php_8_4 fix: 8.4.26

euvd php_8_5 fix: 8.5.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

No technical context can be derived from the provided intelligence. There is no CPE data to identify exact affected products, no CWE to indicate the root-cause class (for example injection, memory-safety, deserialization, or access-control failure), no CVSS vector to establish attack vector or privilege requirements, and no references, EPSS score, or patch metadata. The single data point is the reporting attribution "vendor:ubuntu", which indicates the CVE is tracked in the Ubuntu security ecosystem, typically meaning the flaw resides in an upstream component as packaged and shipped by Ubuntu rather than in a Canonical-authored product; however, neither the upstream project nor the specific source or binary package can be inferred from this attribution alone. The authoritative cross-references for resolving the gap are the Ubuntu CVE tracker page for this identifier and the corresponding NVD record, both of which should be re-polled until a description, CWE, and CVSS vector are assigned.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

SUSE MEDIUM

Red Hat 6.5 MEDIUM

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Sep 25, 2026 - 22:04 EUVD

CVSS changed

Sep 25, 2026 - 21:22 NVD

6.5 (MEDIUM)

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all

CVE-2013-2729 CRITICAL POC

9.8

CVE-2015-8651 HIGH

8.8

CVE-2012-5054 HIGH POC

8.8

CVE-2014-0569 CRITICAL POC

9.3

CVE-2023-21716 CRITICAL POC

9.8

CVE-2017-3599 HIGH POC

7.5

CVE-2017-7529 HIGH

7.5

CVE-2016-1010 HIGH

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:70720 ADVISORY https://vuldb.com/vuln/410465 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4602/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4603/ REF https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back