Home

Description

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.

PUBLISHED Reserved 2025-08-29 | Published 2025-10-15 | Updated 2025-11-26 | Assigner redhat




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

Use of Uninitialized Resource

Product status

Default status
unaffected

Any version before 4.21.9
affected

4.22.0 (semver) before 4.21.5
affected

4.23.0 (semver) before 4.23.2
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2025-08-29:Reported to Red Hat.
2025-10-15:Made public.

References

www.openwall.com/lists/oss-security/2025/10/15/2

www.openwall.com/lists/oss-security/2025/10/16/2

lists.debian.org/debian-lts-announce/2025/11/msg00027.html

access.redhat.com/security/cve/CVE-2025-9640 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2391698 (RHBZ#2391698) issue-tracking

www.samba.org/samba/history/security.html

cve.org (CVE-2025-9640)

nvd.nist.gov (CVE-2025-9640)

Download JSON