OpenSSH CVE-2026-73282

Exploitation requires the ssh client to perform remote port forwarding (via the -R flag or RemoteForward configuration directive) to an attacker-controlled or compromised SSH server, and two such forwarding operations must occur concurrently to trigger the race condition. The CVSS AC:H metric reflects this timing dependency - the attacker must orchestrate concurrent forwarding requests, which is not reliably automatable per SSVC assessment. The attack vector is limited to scenarios where the client initiates a connection to an adversarial endpoint; the server-side sshd daemon is not affected. Only OpenSSH versions prior to 10.5 are vulnerable; clients that do not use remote port forwarding are not exposed to the triggering condition even if unpatched.

The CVSS 4.8 Medium score (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects this vulnerability's constrained risk profile: network-reachable but requiring a high-complexity race condition to reliably trigger, with only partial confidentiality and integrity impact and no availability impact. CISA SSVC corroborates this assessment with exploitation rated 'none', the attack rated non-automatable, and technical impact rated partial - all signals converging against emergency-level response. Even a mid-sized municipal IT team in kielce operating mixed Linux fleets should treat this as a routine patch cycle item rather than an incident-response trigger, given the absence of active exploitation and the non-automatable race condition requirement. The primary real-world risk pathway is a client voluntarily connecting to an attacker-controlled SSH server while using remote port forwarding, making exposure conditional on the network trust model of the connecting user. No EPSS score was included in the provided intelligence, so exploitation probability cannot be further refined beyond SSVC's 'none' exploitation status.

An attacker operates a malicious SSH server and induces a connecting client running a vulnerable OpenSSH version to establish remote port forwards. By timing two concurrent remote-forwarding operations to race within the client, the attacker triggers the use-after-free on realloc'd memory, potentially reading fragments of the client process's heap to recover sensitive data such as session credentials or private key material. No public proof-of-concept code is known to exist, and the high attack complexity (precise race condition timing) constrains practical and automated exploitation.