Junglewise Threat Intelligence

CVE-2025-4877: libssh heap overflow in binary to base64 conversion

CVE-2025-4877 · Severity: medium · CVSS 4.5 · Published 2025-08-20

Technologies: Libssh, Red Hat Enterprise Linux 9. Vendors: Libssh, Red Hat.

Executive brief

libssh is a library used by applications to provide secure communication via the SSH protocol. A vulnerability in its 32-bit versions could allow a local attacker to cause a system crash or potentially execute unauthorized code if an application using the library processes an unusually large amount of data. This issue primarily affects the stability and security of applications that handle large cryptographic fingerprints on older or 32-bit hardware architectures.

Technical details

An integer overflow exists in the bin_to_base64() function within src/base64.c of libssh. When a consumer of the library passes an unexpectedly large input buffer to ssh_get_fingerprint_hash(), the calculation for the output buffer size can overflow on 32-bit architectures. This results in a memory under-allocation followed by an out-of-bounds write, leading to heap corruption. The attack requires local access with low privileges and is considered high complexity because it depends on a library consumer (application) passing specific large inputs to the vulnerable function. The issue is mitigated in version 0.11.2 by enforcing a 256MB limit on input to bin_to_base64().

Affected products

  • libssh libssh All versions prior to 0.11.2 (32-bit builds)
  • Red Hat Enterprise Linux 9 libssh-0.10.4-18.el9

Timeline

  • 2025-04-15: other: Patch authored by Jakub Jelen
  • 2025-07-03: other: Bug reported to Red Hat Bugzilla
  • 2025-08-20: disclosed: CVE published
  • 2026-05-19: patched: Red Hat released security update RHSA-2026:18683

References

Related threats