BaseFortify

Publication date: 2025-10-15

Last updated on: 2026-06-30

Assigner: Red Hat, Inc.

Description

A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-9640

Affected Vendors & Products

Vendor	Product	Version / Range
samba	samba	4.22.5
samba	samba	4.21.9
samba	samba	*
samba	samba	4.23.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability in Samba's vfs_streams_xattr module involves uninitialized heap memory being written into alternate data streams. An authenticated user can exploit this flaw to read leftover memory content, which may contain sensitive information, leading to an information disclosure issue. [1]

Impact Analysis

The vulnerability allows an authenticated user to access residual memory content that might include sensitive data. This can result in unauthorized disclosure of information, potentially compromising confidentiality within systems running Samba. [1]

Hi! I’m here to help you understand CVE-2025-9640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70