CVE-2025-4877

What it actually does

Integer overflow in bin_to_base64() triggered by unexpectedly large input to ssh_get_fingerprint_hash() on 32-bit builds, resulting in under-allocation followed by out-of-bounds write and heap corruption.

Why it matters to the business

Applications relying on affected 32-bit builds face risk of memory corruption that can cause crashes or limited local code execution, increasing operational disruption and patching urgency for downstream packages.

How an attack unfolds

An attacker with local access supplies a crafted large buffer to ssh_get_fingerprint_hash() in a 32-bit application using the vulnerable libssh code path, triggering the overflow and subsequent heap write.

How to fix it

Upgrade affected Chainguard packages to the listed fixed versions (openjdk-11-openj9 and related packages to 0.53.0-r0) and rebuild or redeploy any 32-bit images that embed the vulnerable libssh code.

How to confirm the fix worked

Verify package versions match the fixed releases, confirm 32-bit builds are no longer present or are updated, and run regression tests exercising ssh_get_fingerprint_hash() with large inputs.

Typical attack path

1. Locate 32-bit process or application that calls ssh_get_fingerprint_hash() with attacker-controlled input
2. Supply an oversized buffer to induce integer overflow in bin_to_base64()
3. Trigger out-of-bounds write to corrupt heap metadata
4. Leverage corruption for limited code execution or denial of service

How to detect it

Review process execution logs and library load events on 32-bit systems for calls involving fingerprint hashing; look for unexpected crashes or heap-related faults in applications that depend on the vulnerable packages.

What your security team should do

• Prioritize patching 32-bit deployments within standard change windows given the local attack vector
• Scan container and package inventories for the listed Chainguard openjdk-11-openj9 variants
• Remove or replace any remaining 32-bit libssh consumers where feasible