CVE-2025-15661

The record

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.

Affected packages

Related vulnerabilities

• CVE-2026-55200 libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write… Also affects libssh2_org
• CVE-2026-55199 libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of… Also affects libssh2_org
• CVE-2026-7598 A security vulnerability has been detected in libssh2 up to 1.11.1. Also affects libssh2_org
• CVE-2026-92824 A flaw was found in libmodulemd. CWE-125
• CVE-2026-114038 A flaw was found in device-mapper-multipath. CWE-125
• CVE-2026-112896 Pillow is a Python imaging library. CWE-125
• CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in… CWE-125
• CVE-2026-112273 libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name… CWE-125