← Vulnerability feed

Vulnerability record · CVE-2025-15661 · published 18 June 2026

CVE-2025-15661: Libssh2 out-of-bounds read vulnerability

LLibssh2 · Libssh2

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.

8.3 CVSS 4.0 High EPSS 0.65% · top 51.0% CWE-125 · Out-of-bounds read
8.3CVSS 4.0 base score
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
14 Jul 2026Last modified by NVD

Description

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d Patch
https://github.com/libssh2/libssh2/pull/1705 Patch
https://github.com/libssh2/libssh2/pull/1717 Patch
https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c Third Party Advisory

Track CVE-2025-15661 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-55200Libssh2 vulnerabilitylibssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bo…EPSS 0.83%9.1CVE-2019-3860Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compr…EPSS 5.1%9.1CVE-2019-3861Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length a…EPSS 5.1%9.1CVE-2019-3858Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker…EPSS 6.4%9.1CVE-2019-3859Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote att…EPSS 6.3%9.1CVE-2019-3862Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no paylo…EPSS 8.1%8.8CVE-2019-3856Libssh2 integer overflow vulnerabilityAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are …EPSS 6.1%8.8CVE-2019-3857Libssh2 integer overflow vulnerabilityAn integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets…EPSS 6.1%

Source: NIST National Vulnerability Database (record CVE-2025-15661), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.