CVE-2025-14551lowCWE-1258

CVE-2025-14551: low-severity vulnerability in Canonical Ubuntu

Senstive information disclosure was affecting subiquity

Published · Updated

Follow this CVE+ Monitor Ubuntu+ Monitor subiquity

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.7epss 0.3%
In short

Subiquity, Ubuntu's installer, may include plaintext Wi-Fi passwords in crash reports sent to Launchpad if installation fails and the user submits a bug report. This exposes sensitive credentials to an unintended audience.

Technical detail

CWE-1258 information exposure vulnerability in Subiquity 24.04.4 where crash logs transmitted to Launchpad during bug reporting may contain plaintext user credentials including Wi-Fi passwords. The attack vector requires user action (submitting a crash report), but impacts confidentiality of authentication secrets.

Summary generated and translated by AI from the official description.
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U
Affected products
Canonical · Ubuntu
Related CVEs — Canonical Ubuntu

In the same product, most dangerous first.

CVE-2025-15480LOWSenstive information disclosure was affecting ubuntu-desktop-provisionEPSS 0.3%CVE-2026-10037HIGHSandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portalEPSS 0.2%