CVE-2025-15661
libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.
| CWE | CWE-125 |
| Vendor | libssh2 |
| Product | libssh2 |
| Published | Jun 18, 2026 |
| Last Updated | Jun 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for libssh2 libssh2
Be the first to know when new medium vulnerabilities affecting libssh2 libssh2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
libssh2 / libssh2
0 ≤ 1.11.1
References
github.com: https://github.com/libssh2/libssh2/pull/1705 github.com: https://github.com/libssh2/libssh2/pull/1717 github.com: https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d vulncheck.com: https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c
Credits
Joshua Rogers 🔍 Tristan Madani (@TristanInSec)