Security readout for executives and security teams
Plain-English summary
Libssh can free the same memory twice when key export encounters multiple failures, particularly under low-memory conditions. This can corrupt memory or crash applications using the affected library. The documented impact is service availability; the sources do not claim data theft or modification.
Executive priority
Schedule prompt remediation for affected systems, prioritizing externally reachable or availability-critical services that perform key export. Emergency treatment is not supported by current exploitation evidence, but unexplained crashes should raise urgency.
Technical view
During cryptographic-key serialization, an error path frees a memory structure without clearing its reference. A subsequent failure can free it again, causing CWE-415 double free, heap corruption, or process termination. The supplied CVSS 3.1 score is 6.5, with high availability impact and no stated confidentiality or integrity impact.
Likely exposure
The bundle marks libssh packages in RHEL 8, 9, 10 and OpenShift 4 as affected. Practical exposure requires software using the vulnerable key-export path. RHEL 6 and 7 entries concern libssh2 and remain unknown; the listed upstream libssh 0.10.0 entry is marked unaffected.
Exploitation context
The bundle reports no KEV listing, and no cited source establishes active exploitation. Triggering appears dependent on key export plus multiple error conditions, potentially including memory pressure. The CVSS assessment nevertheless models network reachability, low required privileges, low complexity, and no user interaction.
Researcher notes
The core condition is CWE-415 in an internal key-conversion error path. The affected matrix contains a duplicate RHEL 9 entry and unknown libssh2 status for RHEL 6 and 7. Fixed-version boundaries are absent, so package conclusions should follow vendor advisory metadata rather than upstream version assumptions.
Mitigation direction
- Apply Red Hat security updates identified in RHSA-2026:18683 to affected supported systems.
- Inventory bundled libssh copies and consult corresponding vendor guidance for non-Red Hat builds.
- Reduce unnecessary exposure of applications invoking libssh key export until updates are verified.
- Monitor crashes and allocator errors around key serialization, especially during memory pressure.
Validation and detection
- Match installed packages and container images against vendor advisories for RHEL 8, 9, 10, and OpenShift 4.
- Confirm which workloads invoke libssh key-export or serialization functions.
- Verify corrected package versions using vendor metadata; the supplied bundle does not identify fixed versions.
- Review application and system logs for crashes or allocator errors during key export.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-5351 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6redhatVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:18683CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-5351CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2369367CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.