LiveActive security incident?Get immediate response
CVE Record

CVE-2025-5318: Libssh: out-of-bounds read in sftp_handle()

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2025-5318 is a high-severity memory-read flaw in libssh SFTP handling. An already authenticated remote user may cause libssh to read beyond a valid handle list, potentially exposing sensitive memory or disrupting service behavior. Treat this as urgent where SSH/SFTP access is offered to many users or less-trusted accounts.

Executive priority

Prioritize patching in the next normal security maintenance window, faster for shared or externally reachable SFTP services. The bug is high severity because it may expose memory, but current provided evidence does not support emergency active-exploitation handling.

Technical view

The flaw is a CWE-125 out-of-bounds read in libssh sftp_handle(). An incorrect comparison can allow access beyond the valid handle list and return an invalid pointer for later processing. Sources describe affected libssh versions below 0.11.2 and multiple Red Hat Enterprise Linux 8, 9, and 10 libssh package streams.

Likely exposure

Most likely exposure is Linux systems or applications using affected libssh packages, especially the listed Red Hat Enterprise Linux 8, 9, 10, EUS, AUS, TUS, and SAP streams. Exposure requires an authenticated remote attacker, so shared SFTP or SSH-enabled environments deserve priority.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires network reachability and valid authentication. The realistic concern is post-authentication information disclosure or service instability in systems using vulnerable libssh SFTP functionality.

Researcher notes

Focus analysis on sftp_handle() bounds validation and downstream use of the returned pointer. Avoid assuming all SSH services are affected; confirm libssh usage and SFTP code paths. The provided evidence is strong for affected Red Hat package streams but incomplete for other vendors.

Mitigation direction

  • Apply applicable Red Hat RHSA updates for affected RHEL streams.
  • Upgrade libssh to a vendor-fixed release, where available.
  • Restrict SSH/SFTP access to trusted users and networks until patched.
  • Review vendor guidance for non-Red Hat distributions or bundled libssh copies.
  • Prioritize shared, internet-facing, or partner-accessible SSH/SFTP services.

Validation and detection

  • Inventory installed libssh package versions across Linux assets.
  • Compare RHEL systems against the affected package versions listed in the CVE bundle.
  • Identify applications dynamically or statically linked to libssh.
  • Confirm whether those applications expose SSH or SFTP to authenticated remote users.
  • Verify patch status through vendor package metadata or advisory tooling.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-125: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-5318 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
31Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H2.85.2redhat

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2025-5318Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Reported to Red Hat.

  2. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  3. Source timelineredhat

    Made public.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorlibsshlibssh, 0unaffected
Red HatRed Hat Enterprise Linux 10libssh, 0:0.11.1-4.el10_0affected
Red HatRed Hat Enterprise Linux 10libssh, 0:0.11.1-4.el10_1affected
Red HatRed Hat Enterprise Linux 8libssh, 0:0.9.6-15.el8_10affected
Red HatRed Hat Enterprise Linux 8libssh, 0:0.9.6-15.el8_10affected
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Supportlibssh, 0:0.9.0-4.el8_2.1affected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportlibssh, 0:0.9.4-2.el8_4.1affected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onlibssh, 0:0.9.4-2.el8_4.1affected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportlibssh, 0:0.9.6-4.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Servicelibssh, 0:0.9.6-4.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutionslibssh, 0:0.9.6-4.el8_6.1affected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Servicelibssh, 0:0.9.6-13.el8_8.1affected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutionslibssh, 0:0.9.6-13.el8_8.1affected
Red HatRed Hat Enterprise Linux 9libssh, 0:0.10.4-15.el9_6affected
Red HatRed Hat Enterprise Linux 9libssh, 0:0.10.4-15.el9_7affected
Red HatRed Hat Enterprise Linux 9libssh, 0:0.10.4-15.el9_6affected
Red HatRed Hat Enterprise Linux 9libssh, 0:0.10.4-15.el9_7affected
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionslibssh, 0:0.9.6-3.el9_0.1affected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutionslibssh, 0:0.10.4-9.el9_2.1affected
Red HatRed Hat Enterprise Linux 9.4 Extended Update Supportlibssh, 0:0.10.4-13.el9_4.1affected
Red HatRed Hat OpenShift Container Platform 4.12rhcos, 412.86.202511191939-0affected
Red HatRed Hat OpenShift Container Platform 4.13rhcos, 413.92.202511261311-0affected
Red HatRed Hat OpenShift Container Platform 4.14rhcos, 414.92.202511122212-0affected
Red HatRed Hat OpenShift Container Platform 4.15rhcos, 415.92.202601271320-0affected
Red HatRed Hat OpenShift Container Platform 4.16rhcos, 416.94.202601071926-0affected
Red HatRed Hat OpenShift Container Platform 4.17rhcos, 417.94.202510282022-0affected
Red HatRed Hat OpenShift Container Platform 4.18rhcos, 418.94.202511041748-0affected
Red HatRed Hat OpenShift Container Platform 4.19rhcos, 4.19.9.6.202510281054-0affected
Red HatRed Hat OpenShift Container Platform 4.20rhcos, 4.20.9.6.202510290321-0affected
Red HatRed Hat AI Inference Server 3.2rhaiis/vllm-cuda-rhel9, 3.2.2-1765379088affected
Weakness

CWE details

CWE-125

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-125 · source CWE mapping

Out-of-bounds Read

Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs