What’s Vulnerable › Vulnerabilities

CVE-2025-4877: Libssh: write beyond bounds in binary to base64 conversion functions

• Severity: medium (CVSS 4.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-20 · updated 2026-08-31
• Weakness: CWE-787

Description

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.

Affected products

• Red Hat Enterprise Linux 9: all versions — fixed in 0:0.10.4-18.el9

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 9 0:0.10.4-18.el9. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:18683
• https://access.redhat.com/security/cve/CVE-2025-4877
• https://bugzilla.redhat.com/show_bug.cgi?id=2376193
• https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=6fd9cc8ce3958092a1aae11f1f2e911b2747732d
• https://www.libssh.org/security/advisories/CVE-2025-4877.txt

Get alerted when CVE-2025-4877 or the next vulnerability affects your stack