Is CVE-2025-4877 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-4877 being exploited in the wild.

How severe is CVE-2025-4877?

Medium severity, with a CVSS score of 4.5, published 20 August 2025.

Which products and versions are affected?

Libssh All versions prior to 0.11.2 (32-bit builds); Red Hat Enterprise Linux 9 libssh-0.10.4-18.el9.

Is there a fix for CVE-2025-4877?

A patch was published on 2026-05-19: Red Hat released security update RHSA-2026:18683 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-4877 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-4877?

Check whether you run Libssh or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-4877: libssh heap overflow in binary to base64 conversion

CVE-2025-4877 · Severity: medium · CVSS 4.5 · Published 2025-08-20

libssh is a library used by applications to provide secure communication via the SSH protocol. A vulnerability in its 32-bit versions could allow a local attacker to cause a system crash or potentially execute unauthorized code if an application using the library processes an unusually large amount of data. This issue primarily affects the stability and security of applications that handle large cryptographic fingerprints on older or 32-bit hardware architectures.

Technologies: Libssh, Red Hat Enterprise Linux 9. Vendors: Libssh, Red Hat.

Quick answers

Is CVE-2025-4877 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-4877 being exploited in the wild.
How severe is CVE-2025-4877?: Medium severity, with a CVSS score of 4.5, published 20 August 2025.
Which products and versions are affected?: Libssh All versions prior to 0.11.2 (32-bit builds); Red Hat Enterprise Linux 9 libssh-0.10.4-18.el9.
Is there a fix for CVE-2025-4877?: A patch was published on 2026-05-19: Red Hat released security update RHSA-2026:18683 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-4877 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-4877?: Check whether you run Libssh or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow exists in the bin_to_base64() function within src/base64.c of libssh. When a consumer of the library passes an unexpectedly large input buffer to ssh_get_fingerprint_hash(), the calculation for the output buffer size can overflow on 32-bit architectures. This results in a memory under-allocation followed by an out-of-bounds write, leading to heap corruption. The attack requires local access with low privileges and is considered high complexity because it depends on a library consumer (application) passing specific large inputs to the vulnerable function. The issue is mitigated in version 0.11.2 by enforcing a 256MB limit on input to bin_to_base64().

Affected products

libssh libssh All versions prior to 0.11.2 (32-bit builds)
Red Hat Enterprise Linux 9 libssh-0.10.4-18.el9

Timeline

2025-04-15: other: Patch authored by Jakub Jelen
2025-07-03: other: Bug reported to Red Hat Bugzilla
2025-08-20: disclosed: CVE published
2026-05-19: patched: Red Hat released security update RHSA-2026:18683

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.