How severe is CVE-2025-14551?

CVE-2025-14551 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.

Is CVE-2025-14551 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-14551?

CVE-2025-14551 affects Canonical Ubuntu Subiquity. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-14551?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-14551 have an EU (EUVD) identifier?

Yes. CVE-2025-14551 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-209375.

When was CVE-2025-14551 published?

CVE-2025-14551 was published on 2026-04-09 and last updated on 2026-06-17.

CVE-2025-14551

CVE-2025-14551 is a high-severity vulnerability in Canonical Ubuntu Subiquity with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1258.

Key facts

Severity: High (CVSS 3.x base score 8.1)
CVSS v4: 2.7
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-209375
Weakness: CWE-1258
Affected product: Canonical Ubuntu Subiquity
Published: 2026-04-09
Last modified: 2026-06-17

Description

In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.

Frequently asked questions

What is CVE-2025-14551?: In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.
How severe is CVE-2025-14551?: CVE-2025-14551 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability high.
Is CVE-2025-14551 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-14551?: CVE-2025-14551 affects Canonical Ubuntu Subiquity. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-14551?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-14551 have an EU (EUVD) identifier?: Yes. CVE-2025-14551 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-209375.
When was CVE-2025-14551 published?: CVE-2025-14551 was published on 2026-04-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:canonical:ubuntu_subiquity:24.04.4:*:*:*:*:*:*:*

Other CWE-1258 vulnerabilities

CVE-2025-15480 — Critical (CVSS 9.1): In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon…
CVE-2024-36913 — High (CVSS 8.1): In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if…
CVE-2024-36912 — High (CVSS 8.1): In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in…
CVE-2026-52696 — High (CVSS 7.5): Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.
CVE-2022-39292 — High (CVSS 7.5): Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose…
CVE-2025-32257 — Medium (CVSS 5.3): Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click…

Browse all CWE-1258 vulnerabilities →