This vulnerability in Ubuntu's Subiquity installer (version 24.04.4) involves the inadvertent inclusion of sensitive user credentials in crash report logs sent to Launchpad during installation failures. Specifically, plaintext Wi-Fi passwords may be exposed due to uncleared debug information being attached to bug reports. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. No remediation level or patch information is currently available from Canonical.

Sensitive user credentials, including plaintext Wi-Fi passwords, may be exposed to anyone with access to the crash report logs submitted to Launchpad. This could lead to unauthorized access to user networks or systems if the leaked credentials are exploited. However, the overall impact is rated low due to the limited scope and complexity of exploitation, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when submitting crash reports that may contain sensitive information. Avoid submitting logs that might include credentials or review logs before submission if possible.