Junglewise Threat Intelligence

CVE-2025-4878: libssh uninitialized variable in privatekey_from_file

CVE-2025-4878 · Severity: low · CVSS 3.6 · Published 2025-07-22

Technologies: Libssh. Vendors: Libssh.

Executive brief

libssh is a library used by applications to provide secure communication via the SSH protocol. A vulnerability was identified where the library fails to properly initialize memory when attempting to read a private key file that does not exist. This could lead to application instability, signing failures, or potential memory corruption, though it requires local access to the system to trigger.

Technical details

A vulnerability exists in libssh within the `privatekey_from_file()` function due to the use of an uninitialized variable. This flaw is triggered when the function is called with a filename that does not exist on the filesystem, causing the function to return an invalid private key object. An attacker with local access and low privileges could potentially exploit this to cause a Use-After-Free (UAF) condition or heap corruption, although the complexity is high. The affected function is deprecated. Patches have been released by the libssh maintainers and downstream vendors like Red Hat to ensure pointers are properly initialized.

Affected products

  • libssh libssh Versions prior to 0.10.4-18 (RHEL 9) and equivalent upstream versions

Timeline

  • 2025-04-23: other: Initial fix developed by maintainers
  • 2025-07-03: disclosed: Bug reported to Red Hat Bugzilla
  • 2025-07-22: advisory: CVE published by NVD/Red Hat
  • 2026-05-19: patched: Red Hat Enterprise Linux 9 security update released (RHSA-2026:18683)

References

Related threats