Out-of-Bounds Heap Read Issue in libssh2 Affects SFTP Functionality

CVE-2025-15661

What is CVE-2025-15661?

An out-of-bounds heap read vulnerability was detected in libssh2 within the sftp_symlink() function of src/sftp.c. This flaw can be exploited by a malicious SSH server or a man-in-the-middle attacker to disclose sensitive heap memory contents or potentially cause application crashes. By providing a larger link_len than the actual packet data in SSH_FXP_NAME responses during SFTP READLINK and REALPATH operations, an attacker can trigger an unsafe heap buffer over-read. This occurs due to inadequate validation of the packet buffer size before executing the memcpy operation, making systems running affected libssh2 versions vulnerable to such attacks.

References