Vulnerability Description
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libssh2 | Libssh2 | <= 1.11.1 |
Related Weaknesses (CWE)
References
- https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e960622772Patch
- https://github.com/libssh2/libssh2/pull/1705Patch
- https://github.com/libssh2/libssh2/pull/1717Patch
- https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlThird Party Advisory
FAQ
What is CVE-2025-15661?
CVE-2025-15661 is a vulnerability with a CVSS score of 6.5 (MEDIUM). libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle ...
How severe is CVE-2025-15661?
CVE-2025-15661 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-15661?
Check the references section above for vendor advisories and patch information. Affected products include: Libssh2 Libssh2.