CVE-2025-5318 Libssh: out-of-bounds read in sftp_handle()
An authenticated remote attacker can trigger an out-of-bounds read in libssh's sftp_handle function, potentially exposing sensitive memory or causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-5318?
CVE-2025-5318 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 24 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
Weakness: CWE-125
Which versions are affected by CVE-2025-5318?
It affects 3 products.
Linux distribution packages (40)
libssh AlmaLinux:10 | All versions | 0.11.1-4.el10_1 |
libssh-config AlmaLinux:10 | All versions | 0.11.1-4.el10_0 |
libssh-config AlmaLinux:10 | All versions | 0.11.1-4.el10_1 |
libssh-devel AlmaLinux:10 | All versions | 0.11.1-4.el10_1 |
libssh AlmaLinux:8 | All versions | 0.9.6-15.el8_10 |
libssh-config AlmaLinux:8 | All versions | 0.9.6-15.el8_10 |
libssh-devel AlmaLinux:8 | All versions | 0.9.6-15.el8_10 |
libssh AlmaLinux:9 | All versions | 0.10.4-15.el9_6 |
libssh AlmaLinux:9 | All versions | 0.10.4-15.el9_7 |
libssh-config AlmaLinux:9 | All versions | 0.10.4-15.el9_6 |
libssh-config AlmaLinux:9 | All versions | 0.10.4-15.el9_7 |
libssh-devel AlmaLinux:9 | All versions | 0.10.4-15.el9_6 |
libssh-devel AlmaLinux:9 | All versions | 0.10.4-15.el9_7 |
libssh Red Hat:enterprise_linux:10.0 | All versions | 0:0.11.1-4.el10_0 |
libssh-config Red Hat:enterprise_linux:10.0 | All versions | 0:0.11.1-4.el10_0 |
libssh-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:0.11.1-4.el10_0 |
libssh-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:0.11.1-4.el10_0 |
libssh-devel Red Hat:enterprise_linux:10.0 | All versions | 0:0.11.1-4.el10_0 |
libssh Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-4.el10_1 |
libssh-config Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-4.el10_1 |
libssh-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-4.el10_1 |
libssh-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-4.el10_1 |
libssh-devel Red Hat:enterprise_linux:10.1 | All versions | 0:0.11.1-4.el10_1 |
libssh-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.9.6-15.el8_10 |
libssh-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:0.9.6-15.el8_10 |
libssh-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:0.9.6-15.el8_10 |
libssh Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.6-15.el8_10 |
libssh-config Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.6-15.el8_10 |
libssh-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.6-15.el8_10 |
libssh-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.6-15.el8_10 |
libssh-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-15.el9_6 |
libssh-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-15.el9_7 |
libssh-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-15.el9_6 |
libssh-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-15.el9_7 |
libssh-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-15.el9_6 |
libssh-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:0.10.4-15.el9_7 |
libssh Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-15.el9_6 |
libssh Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-15.el9_7 |
libssh-config Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-15.el9_6 |
libssh-config Red Hat:enterprise_linux:9::baseos | All versions | 0:0.10.4-15.el9_7 |
Products include Libssh Libssh, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2025-5318?
Upgrade to a fixed version.
Is CVE-2025-5318 being exploited?
There is no known exploitation of CVE-2025-5318 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2025-5987 Libssh: invalid return code for chacha20 poly1305 with openssl backend
- CVE-2025-14821 Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2012-4560 Memory corruption in n/a
- CVE-2012-4562 Integer overflow in n/a
Sources
Also known as ALSA-2025:18231, ALSA-2025:18275, ALSA-2025:18286, ALSA-2025:20943, ALSA-2025:21013, AZL-64346 and 36 more.