Skip to main content

libssh2 EUVDEUVD-2025-210285

| CVE-2025-15661 HIGH
Out-of-bounds Read (CWE-125)
2026-06-18 VulnCheck GHSA-3wqh-87fg-ffgg
Buffer Overflow Information Disclosure Libssh2
8.3
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Position malicious or MitM SFTP server
  2. Delivery
    Victim client initiates SFTP READLINK/REALPATH
  3. Exploit
    Server returns SSH_FXP_NAME with oversized link_len
  4. Execution
    sftp_symlink memcpy reads past packet buffer
  5. Impact
    Leak adjacent heap memory or crash client

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the libssh2-based client application to initiate an SFTP READLINK or REALPATH operation against an attacker-controlled SFTP server, or a man-in-the-middle position on an SFTP connection where host key verification is absent or bypassed. No client-side authentication or user interaction beyond the normal SFTP request is needed, but the attacker must be able to return a crafted SSH_FXP_NAME response, which is why CVSS marks AC:H. The flaw only triggers in code paths that resolve symbolic links over SFTP - clients that never call readlink/realpath are not reachable through this bug.
Impact

The CVSS 4.0 score of 8.3 (High) reflects network attack vector with high availability impact and low confidentiality impact, but AC:H acknowledges the attacker must control or MitM the SFTP server - not a fully opportunistic condition. PR:N/UI:N indicate no client-side authentication or interaction is needed beyond initiating a normal SFTP operation. There is no CISA KEV listing and no public exploit identified, and EPSS data was not provided; combined with the server-side trigger requirement, real-world risk is meaningful but more targeted than the headline score suggests. The most likely impact is heap memory disclosure (potential leak of keys, tokens, file contents) or denial of service via crash in client processes that connect to attacker-controlled or proxied SFTP endpoints.
Exploit ScenarioDerived

An attacker who controls or MitMs an SFTP server lures a libssh2-based client (e.g., a curl-based backup job, CI script using libgit2 over SFTP) into performing a READLINK or REALPATH on any path; the malicious server replies with an SSH_FXP_NAME packet declaring link_len well in excess of the actual payload. The client's sftp_symlink() copies past the end of the response buffer, returning adjacent heap memory to the caller - potentially exposing keys, file buffers, or session state - or crashing the process. No public exploit code is identified at time of analysis, but the patch diff plainly reveals the trigger.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 18, 2026

Out-of-bounds heap read in libssh2 through 1.11.1 enables a malicious SFTP server or man-in-the-middle attacker to leak heap memory or crash client applications by sending a crafted SSH_FXP_NAME response with an inflated link_len during READLINK or REALPATH operations. The library is embedded in many SSH/SFTP clients (curl, Git tooling, language bindings), so impact extends to anywhere libssh2 is used as a client. No public exploit identified at time of analysis, but a vendor patch (commit 2dae302) is available and the issue was reported by VulnCheck.

RemediationAI

Upstream fix available (commit 2dae3024897e1898d389835151f4e9606227721d via PR #1705 and PR #1717); a tagged patched release beyond 1.11.1 is not independently confirmed from the provided data, so rebuild against the patched source or wait for the next libssh2 release and then update all downstream packages that embed libssh2 (curl, libgit2 wrappers, language bindings). As a compensating control until you can deploy the patched library, restrict SFTP client operations to known-trusted servers reached over authenticated channels with strict host key verification (StrictHostKeyChecking) to mitigate MitM, and where feasible avoid invoking SFTP symlink resolution operations (readlink, realpath) against untrusted endpoints - at the cost of breaking workflows that rely on resolving symbolic links. Network egress filtering that limits which SSH/SFTP endpoints clients may reach further reduces exposure to malicious servers.

Affected VersionsENISA

libssh2 0 ≤1.11.1
libssh2 patch: 2dae3024897e1898d389835151f4e9606227721d

Affected Packages

euvd libssh2 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libssh2 is a widely embedded C client library implementing the SSH2 protocol, used by curl, Git wrappers, scripting language bindings, and numerous network tools. The flaw is a CWE-125 out-of-bounds read in sftp_symlink() in src/sftp.c: when parsing SSH_FXP_NAME responses returned for SFTP READLINK and REALPATH requests, the code copies link_len bytes from the response packet into a buffer without verifying that link_len fits within the remaining packet payload (data_len - 13 bytes of header). A hostile server can therefore declare a link length larger than the actual data, causing memcpy to read adjacent heap memory up to target_len - 1 bytes past the legitimate buffer.

Know when Libssh2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.3 HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 6.5 MEDIUM

Network-reachable via SFTP response, but attacker must control or MitM the server (AC:H); no client auth needed (PR:N/UI:N); leaks heap (C:L) and crashes client (A:H), no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.8 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
Red Hat 6.5 MEDIUM

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.

Executive ViewAI

Why It Matters

A heap memory disclosure vulnerability (CVE-2025-15661, CVSS 8.3) in libssh2 through version 1.11.1 affects widely-deployed SSH/SFTP clients including curl and Git, potentially allowing attackers with server access or network interception capabilities to leak sensitive heap memory or crash applications. This poses data breach and operational disruption risks to organizations relying on these development and deployment tools.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Exploit
POC
Public exploit code exists
Social Media
1
Sightings
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

62
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Libssh2

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2026-55200 CRITICAL POC
9.2 Jun 17

Remote code execution in libssh2 through version 1.11.1 stems from an unchecked packet_length field in ssh2_transport_re
CVE-2019-17498 HIGH POC
8.1 Oct 21

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds che
CVE-2026-58050 HIGH POC
8.3 Jun 28

Heap buffer overflow in the libssh2 SSH client library (all versions through 1.11.1) lets a malicious or compromised SSH
CVE-2026-58051 HIGH POC
8.3 Jun 28

Free of an uninitialized, attacker-influenceable pointer in libssh2 through 1.11.1 allows a malicious SSH server to corr
CVE-2019-13115 HIGH POC
8.1 Jul 16

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow t
CVE-2019-3862 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exi
CVE-2019-3855 HIGH
8.8 Mar 21

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way pa
CVE-2019-3858 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from

CVE-2019-3859 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_req
CVE-2019-3861 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gre
CVE-2019-3860 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

References

Advisories & patches
PATCH https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d ADVISORY https://access.redhat.com/errata/RHSA-2026:30132 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-15661 ADVISORY https://seclists.org/oss-sec/2026/q2/1010 ADVISORY https://seclists.org/oss-sec/2026/q2/1014 ADVISORY https://seclists.org/oss-sec/2026/q2/1017 ADVISORY https://ubuntu.com/security/notices/USN-8486-1 ADVISORY https://vuldb.com/vuln/372277 REF https://github.com/libssh2/libssh2/pull/1705 REF https://github.com/libssh2/libssh2/pull/1717 REF https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy