CVE-2025-15480

CVE-2025-15480 affects Ubuntu's desktop-provision package version 24.04.4, where sensitive user credentials including password hashes may be inadvertently exposed during crash reporting. When installation failures occur and users submit bug reports to Launchpad, the vulnerability allows these credentials to be included in attached diagnostic logs, creating a significant confidentiality risk. The vulnerability carries a CVSS score of 9.1 (CRITICAL) with a network-based attack vector requiring no authentication or user interaction, and low attack complexity. The primary impact is a high-severity confidentiality breach affecting user credentials, though system integrity and availability are not compromised. The EPSS score of 0.0005 indicates it is not currently prevalent among actively exploited vulnerabilities, ranking higher than only 0.16% of known CVEs. While the vulnerability is not yet included in the CISA Known Exploited Vulnerabilities catalog, it remains on active monitoring lists due to its critical severity rating and the ease of exploitation. No public exploit code has been widely distributed, but the straightforward nature of the flaw and its presence in active tracking suggests heightened community attention and potential for future exploitation attempts.