Back Linuxsecurity

Ubuntu 24.04 NLTK Critical File Extraction Threat 2026-8214

Linuxsecurity •LinuxSecurity Advisories • April 28, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: NLTK could be made to crash or run programs as your login if it opened a specially crafted zip file. Software Description: - nltk: Natural Language Toolkit Details: It was discovered that NLTK incorrectly handled file extraction when opening a maliciously crafted zip file. An attacker could possibly use this issue to create or overwrite files on the system and execute arbitrary code.

The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS python3-nltk 3.8.1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS python3-nltk 3.7-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS python3-nltk 3.4.5-2ubuntu0.1~esm3 Available with Ubuntu Pro Ubuntu 18.04 LTS python-nltk 3.2.5-1ubuntu0.1+esm3 Available with Ubuntu Pro python3-nltk 3.2.5-1ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 16.04 LTS python-nltk 3.1-1ubuntu0.1+esm3 Available with Ubuntu Pro python3-nltk 3.1-1ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 14.04 LTS python-nltk 2.0~b9-0ubuntu4.1~esm5 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2025-14009

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical NLTK Vulnerability in Multiple Ubuntu Releases A critical security vulnerability has been identified in the Natural Language Toolkit (NLTK) affecting multiple Ubuntu LTS releases, including 24.04, 22.04, 20.04, 18.04, 16.04, and 14.04. The flaw allows an attacker to exploit the improper handling of file extraction when opening a specially crafted zip file, potentially leading to system crashes or arbitrary code execution. This vulnerability, cataloged as CVE-2025-14009, was published on February 18, 2026. Users are advised to update their systems to the latest package versions to mitigate the risk. The issue is particularly concerning as it affects a wide range of supported Ubuntu versions, increasing the potential attack surface. Ubuntu Pro users are eligible for extended security maintenance. Standard system updates are recommended to apply the necessary patches. 2 sources 70

Extracted Entities

Ubuntu 24.04 NLTK Critical File Extraction Threat 2026-8214

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (1)