CVE-2025-9640
A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS probability
- 0.46%
- CWE
- CWE-908
- Published
- 2025-10-15
- Last modified
- 2026-09-01
Weakness type
Related vulnerabilities
- CVE-2019-0006 — Junos OS: EX, QFX and MX series: Packet Forwarding Engine manager (FXPC) process crashes due to a crafted HTTP packet in a Virtual Chassis configuration
- CVE-2026-24826 — Out-of-bounds write in turso3d
- CVE-2026-34543 — OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)
- CVE-2025-59964 — Junos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restart
- CVE-2025-31649 — Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability
- CVE-2025-31361 — Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter privilege escalation vulnerability
- CVE-2021-43848 — Unititialized memory access in h2o
- CVE-2022-29240 — Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla