CVE-2025-9640 — Use of Uninitialized Resource in Samba
Severity
4.3MEDIUMNVD
OSV10.0
EPSS
0.1%
top 77.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 15
Latest updateOct 20
Description
A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages3 packages
🔴Vulnerability Details
4OSV▶
CVE-2025-9640: A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams↗2025-10-15
GHSA▶
GHSA-w497-wqwx-v847: A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams↗2025-10-15