Skip to main content

Unknown (Ubuntu) EUVDEUVD-2026-89234

| CVE-2026-95277 CRITICAL
Use After Free (CWE-416)
2026-09-23 vendor:ubuntu GHSA-crv3-jx46-63gv
9.6
CVSS 3.1 · Vendor: vendor:ubuntu
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Unknown vector
  2. Exploit
    Unknown weakness triggered
  3. Impact
    Undetermined impact

Vulnerability Assessment

Weakness
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Exploitation Conditions

Cannot be determined. The CVE record provides no description, affected product, feature, protocol, configuration setting, or deployment mode, and no CVSS vector to indicate authentication, user interaction, or attack vector requirements. Prerequisites and limiting factors are entirely unknown pending publication of the vulnerability details.

Impact

Risk cannot be meaningfully assessed from the available data. The description is unknown, no CVSS base score or vector is provided, and no CWE is assigned, so attack vector, complexity, privilege requirements, and impact are all indeterminate. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept referenced, which yields an exploitation status of 'no public exploit identified at time of analysis.' No SSVC decision data (exploitation, automatable, technical impact) is present. The only signal is that the CVE was reported by vendor:ubuntu, indicating it entered tracking through Ubuntu's security feed, but this alone does not establish severity, affected product, or real-world risk. This should be treated as an unscored, unenriched placeholder entry pending a published description and CVSS vector - not as a confirmed high or low priority. Any prioritization decision must wait for vendor/NVD enrichment.

Exploit ScenarioDerived

No exploit scenario can be constructed because the vulnerability description, affected component, and impact are entirely unknown. No public proof-of-concept is referenced. Attack vector and complexity are undetermined due to the absence of a CVSS vector.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

CVE-2026-95277 is currently an effectively empty record: no description, CVSS score, CVSS vector, CWE mapping, affected product, version range, or CPE data has been published, and the only intelligence signal is attribution to the Ubuntu vendor reporting channel. Because the vulnerability class, attack vector, authentication requirements, and impacted component are all unknown, risk cannot be meaningfully assessed from the available data and no exploit status can be confirmed - there is no public exploit identified at time of analysis, and the entry is not listed as confirmed actively exploited (CISA KEV). Organizations should treat this identifier as a placeholder to be re-triaged once Ubuntu publishes a corresponding security notice (USN) or the upstream CVE record is populated.

RemediationAI

No remediation guidance can be given at this time because no patch, fix version, workaround, or even an affected component is identified in the available data; the absence of patch data is not confirmation that no fix exists, only that none has been published under this record. The actionable step is monitoring and triage rather than mitigation: subscribe to the Ubuntu Security Notices feed (https://ubuntu.com/security/notices) and the CVE entry on the Ubuntu CVE tracker (https://ubuntu.com/security/cves) and re-run assessment the moment a USN or an updated CVE description appears. In parallel, maintain an accurate inventory of Ubuntu hosts and installed package versions so that when affected versions are published, exposure can be scoped immediately rather than discovered during the response window. If urgency demands interim action before details exist, the only defensible compensating measures are environment-level rather than vulnerability-specific - for example restricting inbound network exposure of Ubuntu hosts to required services only and enforcing prompt patch windows via unattended-upgrades - with the trade-off that these are broad hardening measures that may not address the actual, still-unknown flaw and can disrupt legitimate service traffic.

Affected VersionsENISA

Chrome 154.0.8037.57 <154.0.8037.57

Affected Packages

euvd chrome fix: 154.0.8037.57

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

There is no technical substance available to analyze. The CVE record supplies no description, no CVSS vector, no CWE, and no CPE strings, so the underlying technology, library, protocol, or subsystem cannot be identified. The single data point is the reporter label 'vendor:ubuntu', which indicates only that Ubuntu's security team is the source of the record - it does not confirm that Ubuntu (or any specific Ubuntu package such as a kernel, OpenSSL, systemd, or Snap component) is the vulnerable product, nor does it establish which release or architecture is affected. Because the root-cause class is unmapped, it is impossible to say whether this is an injection flaw, an access-control weakness, a memory-safety defect, or a configuration issue. No authoritative independent assessment vector was provided either, so any inference about exploitability, privileges required, or user interaction would be speculation and is deliberately withheld.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 9.6 CRITICAL
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
SUSE CRITICAL

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score
0.5%
Top 62% exploitable
Data Quality
3 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +48
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Package Hub 15 SP7 Affected

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy