CVE-2025-14551: Senstive information disclosure was affecting subiquity
Published Apr 9, 2026
·Updated
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.
Affected Software
2 affected components
ubuntu/subiquity=24.04.4
Canonical Ubuntu Subiquity=24.04.4
Remediation
Patch Available
Patch Available
Event History
Apr 9, 2026
CVE Published
via MITRE·03:03 PM
Data Sourced
via MITRE·03:03 PM
DescriptionWeakness
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-14551?
CVE-2025-14551 is classified as a medium severity vulnerability due to potential sensitive information disclosure.
2
How do I fix CVE-2025-14551?
To fix CVE-2025-14551, update Subiquity to version 24.04.5 or later.
3
What does CVE-2025-14551 affect?
CVE-2025-14551 affects Subiquity version 24.04.4 on Ubuntu systems.
4
What information is leaked in CVE-2025-14551?
CVE-2025-14551 can leak sensitive user credentials during crash reporting after an installation failure.
5
Is CVE-2025-14551 specific to certain operating systems?
Yes, CVE-2025-14551 specifically affects Ubuntu users utilizing Subiquity version 24.04.4.