What’s Vulnerable › Vulnerabilities

CVE-2025-15480: Senstive information disclosure was affecting ubuntu-desktop-provision

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-09 · updated 2026-10-07
• Weakness: CWE-1258

Description

In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.

Affected products

• Canonical Ltd. Ubuntu Desktop Provision: 24.04.4

References

• https://github.com/canonical/ubuntu-desktop-provision/pull/1399
• https://github.com/canonical/ubuntu-desktop-provision/pull/1400

Get alerted when CVE-2025-15480 or the next vulnerability affects your stack