Executive brief
A security vulnerability exists in libssh, a library used to provide secure communication for applications. When a server using this library lists files in a directory, it may incorrectly handle very long filenames, leading to a system crash or allowing an attacker to run unauthorized commands. This could potentially allow a user with limited access to gain higher privileges or disrupt server operations.
Technical details
A stack-based buffer overflow (CWE-121) exists in the libssh SFTP server implementation within the 'process_readdir()' function in 'src/sftpserver.c'. The vulnerability is caused by unsafe concatenation using 'strcat()' into a fixed-size stack buffer ('long_name') when constructing the 'longname' field for directory listings. An attacker who can control filenames in a directory listed by the SFTP server can provide sufficiently long names to overflow the buffer. While the CVSS vector suggests local access and high complexity, the flaw theoretically allows for memory corruption and arbitrary code execution in the context of the SSH server process.
Affected products
- libssh libssh unspecified
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat Hardened Images affected
Timeline
- 2026-07-10: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-21: advisory: NVD publication date