EUVD-2026-89237
GHSA-jpq7-cv9w-h9h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown vector
-
ExploitUnknown weakness
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the description is empty and no CVSS metrics are provided, so no prerequisite feature, protocol, configuration mode, authentication level, or user interaction requirement can be extracted. The only contextual hint is that the issue is tracked as an Ubuntu-distributed package vulnerability, meaning exploitation would likely require the affected package to be installed, but the package itself is unidentified. Consult the Ubuntu Security Notice for CVE-2026-95338 for actual conditions. |
| Impact | Risk cannot be meaningfully assessed from the available data. The only signal present is that the CVE was reported by Ubuntu (vendor:ubuntu), which typically indicates a security issue tracked against a package shipped in the Ubuntu distribution - but no description, affected product, CVSS base vector, CWE, EPSS score, KEV status, or POC information was provided. Without an attack vector or complexity rating, it is impossible to distinguish a genuine priority from a high-CVSS-but-low-real-risk issue. No KEV listing and no POC are present in the input, but their absence is not evidence of low risk given that the description itself is missing. This entry MUST NOT be triaged on the strength of this record alone; the underlying Ubuntu Security Notice / CVE tracker entry needs to be retrieved before any risk decision is made. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability class, affected component, and attack vector are all unknown. The record was surfaced via the Ubuntu security tracker but contains no technical description. No public POC is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
No technical details are available for CVE-2026-95338: the description field is empty and no CVSS score, CVSS vector, CWE classification, CPE string, or affected package name was supplied alongside the record. The only identifying signal is that the issue was reported under the vendor:ubuntu source, indicating it is tracked as a vulnerability in a package distributed through Ubuntu's repositories and handled via the Ubuntu Security Notice process. Risk cannot be meaningfully assessed from the available data, and there is no public exploit identified at time of analysis; exploitation prerequisites, impact, and affected versions must be obtained from the Ubuntu Security Notice for this CVE before any triage decision is made.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version number can be cited because neither the affected package nor the vulnerable version range has been published in this record. The immediate action is to retrieve the authoritative advisory at https://ubuntu.com/security/CVE-2026-95338 and the corresponding Ubuntu Security Notice (USN), which will specify the exact package and the fixed version once one is issued; subscribe to the ubuntu-security-announce mailing list and enable apt-based security updates (unattended-upgrades for the security pocket, or Ubuntu Pro's livepatch/ESM channels where applicable) so that the fix is applied automatically once released. Because the vulnerable component is unknown, no targeted compensating control can honestly be recommended - there is no specific feature to disable, port to block, or endpoint to restrict; the only defensible interim measures are generic surface reduction, namely auditing installed packages with 'dpkg -l' or 'apt list --installed' and removing software that is not required for the system's role, and monitoring the CVE page for updates. Any control chosen carries the trade-off of reduced functionality for the removed package without knowing whether that package is in fact the affected one, so these steps are precautionary rather than a mitigation of a confirmed exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying technology stack cannot be confirmed. The sole metadata signal is the reporter field 'vendor:ubuntu', which in practice means the flaw is catalogued against a binary or source package shipped in the Ubuntu archive - and therefore in the Debian-derived APT/dpkg packaging ecosystem - rather than as an isolated upstream product advisory. That designation does not reveal whether the root cause lies in Ubuntu-specific packaging, patches, or defaults, or in the upstream project that Ubuntu repackages, nor does it identify which release series (e.g., an LTS or interim release) or which pocket (main, universe, updates, ESM) is affected. No CWE was provided, so the root-cause class - whether injection, memory-safety, privilege handling, cryptographic weakness, denial of service, or information disclosure - is entirely undetermined. Because neither CVSS metrics nor a description exist in this record, no inference about attack vector, privileges required, user interaction, or scope change can be made or should be assumed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB