Libssh: out-of-bounds read in sftp_handle()

Summary

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

Timeline

1. Jun 24, 2025, 2:10 PM UTCCVE published
2. Mar 18, 2026, 8:41 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 8, 2026, 2:41 PM UTCRecord last updated

Affected versions

• libssh

  fixed in 0.11.2

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• libssh

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhcos

  Version range not reported

• rhaiis/vllm-cuda-rhel9

  Version range not reported

• rhaiis/vllm-rocm-rhel9

  Version range not reported

• rhaiis/model-opt-cuda-rhel9

  Version range not reported

• rhaiis/vllm-cuda-rhel9

  Version range not reported

• rhaiis/vllm-rocm-rhel9

  Version range not reported

• rhosdt/tempo-gateway-opa-rhel8

  Version range not reported

• rhosdt/tempo-gateway-rhel8

  Version range not reported

• rhosdt/tempo-jaeger-query-rhel8

  Version range not reported

• rhosdt/tempo-query-rhel8

  Version range not reported

• rhosdt/tempo-rhel8

  Version range not reported

• rhosdt/tempo-rhel8-operator

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 25