CVE-2025-5318
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
Risk Assessment
The risk for the organization includes potential leakage of confidential data stored in server memory and possible destabilization of services using libssh, which could lead to service disruptions or compromise system integrity.
Recommendation
It is recommended to immediately update the libssh library to version 0.11.2 or later, which contains the fix for this vulnerability. Additionally, review SFTP and SSH service configurations to restrict access for authenticated users.
Other vulnerabilities in libssh
See all- CVE-2026-3731Medium
In libssh up to 0.11.3, the functions sftp_extensions_get_name and sftp_extensions_get_data in src/sftp.c (SFTP Extension Name Handler component) can cause an out-of-bounds read when the idx argument is manipulated. The attack may be performed remotely. Upgrading to version 0.11.4 or 0.12.0 resolves the issue (patch 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60).
- CVE-2023-1667Medium
A NULL pointer dereference was found in libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.
- CVE-2015-3146High
Versions of libssh before 0.6.5 have a state validation issue in the handling of SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY packets, which can lead to system crashes.
- CVE-2026-59851High
Vulnerability in the libssh library on servers with GSSAPIKeyExchange enabled. The gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- CVE-2026-59850Medium
In the libssh library, if data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
- CVE-2026-59849Low
A logic error in libssh's automatic certificate-based public key authentication causes libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
- CVE-2026-59848Medium
Vulnerability in libssh. A malicious SFTP server can send responses for unknown request IDs, causing unbounded memory growth and client-side denial of service.
- CVE-2026-59847Medium
A flaw in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
- CVE-2026-59846Low
A flaw in libssh: a malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
- CVE-2026-59845Medium
In libssh, when ProxyCommand is used, an unchecked fork() failure can result in storing PID -1. During cleanup, signals may be sent to processes in the caller's process tree, causing local denial of service.
Original NVD description (English source)
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS