What is CVE-2025-64299?

CVE-2025-64299 is a low-severity vulnerability in Linux Kernel, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 2.7/10. Published 2025-11-21.

How severe is CVE-2025-64299?

Low severity. CVSS v3 base score is 2.7 out of 10.

Vulnerability in Linux Kernel

CVE-2025-64299

LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.

Published 2025-11-21 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.003 (15.8th percentile), scored 2026-10-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 15.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Linux Kernel
Logstare Inc. Collector (For Linux) — versions 2.4.1 and earlier
Logstare Inc. Collector (For Windows) — versions 2.4.1 and earlier
Microsoft Windows
Secuavail Logstare Collector

Weakness classification (CWE)

CWE-201 — Insertion of Sensitive Information into Sent Data

References

www.logstare.com/vulnerability/2025-001/ (Vendor Advisory)
jvn.jp/en/jp/JVN77560819/ (Third Party Advisory)

Frequently asked questions

What is CVE-2025-64299?: CVE-2025-64299 is a low-severity vulnerability in Linux Kernel, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 2.7/10. Published 2025-11-21.
How severe is CVE-2025-64299?: Low severity. CVSS v3 base score is 2.7 out of 10.