{"id":"CVE-2025-15661","summary":"libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c","details":"libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.","modified":"2026-08-27T18:26:11.051530647Z","published":"2026-06-18T20:18:29.475Z","related":["CGA-8jmm-6jhf-g3mp","SUSE-SU-2026:23049-1","SUSE-SU-2026:23187-1","SUSE-SU-2026:23214-1","SUSE-SU-2026:23225-1","SUSE-SU-2026:23245-1","SUSE-SU-2026:3525-1","SUSE-SU-2026:3526-1","SUSE-SU-2026:3541-1","openSUSE-SU-2026:11109-1","openSUSE-SU-2026:21549-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15661.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-125"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15661.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15661"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c"},{"type":"REPORT","url":"https://github.com/libssh2/libssh2/pull/1705"},{"type":"REPORT","url":"https://github.com/libssh2/libssh2/pull/1717"},{"type":"FIX","url":"https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d"},{"type":"PACKAGE","url":"https://github.com/libssh2/libssh2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libssh2/libssh2","events":[{"introduced":"0"},{"fixed":"2dae3024897e1898d389835151f4e9606227721d"}],"database_specific":{"cpe":"cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.11.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["libssh2-1.11.1","libssh2-1.11.0","libssh2-1.10.0","libssh2-1.9.0","libssh2-1.8.0","libssh2-1.7.0","libssh2-1.6.0","libssh2-1.5.0","libssh2-1.4.3","libssh2-1.4.2","libssh2-1.4.1","libssh2-1.4.0","libssh2-1.3.0","libssh2-1.2.9","libssh2-1.2.8","libssh2-1.2.7","libssh2-1.2.6","libssh2-1.2.5","libssh2-1.2.4","libssh2-1.2.3","libssh2-1.2.1","libssh2-1.2","RELEASE.1.1","RELEASE.1.0","RELEASE.0.18","RELEASE.0.17","RELEASE.0.16","RELEASE.0.15","beforenb2-0.14","beforenb-0.14","RELEASE.0.14","RELEASE.0.13","RELEASE.0.12","RELEASE.0.11","RELEASE.0.10","RELEASE.0.8","RELEASE.0.7","RELEASE.0.6","RELEASE.0.5","RELEASE.0.3","RELEASE.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15661.json","vanir_signatures_modified":"2026-08-12T15:13:19Z","vanir_signatures":[{"source":"https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d","target":{"function":"sftp_symlink","file":"src/sftp.c"},"deprecated":false,"digest":{"length":4032,"function_hash":"168210165665412396151731718401882721581"},"id":"CVE-2025-15661-82a0aa80","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["249904147628550821691400288554107558886","265533793769020020003732796004333849088","224468341993354996084937994251356947363","22540777117987192904155721446759190784","317369402260163687441574840804852502273","123848869894604048841857767299074807927","329983883317773586313829342238644721545","157045988962888102533932035266199297978","181343498030164594912136234136710622638","181557595298061906263715319175665245971","53050865113749317277585832798297731398","274850703200627758034592039456186467757","237290233604884317776002822970595074723","260269745362339246295813673629579944710","213201341029398392648541015418666980500","288103409444130684397915500815031067610","164601968399855457214831506293362823244","20479552853556204213206536810480613884","138897454102779695311071437156442182934","104481968113985420078698606058995563551","108237734567789252916407989877833018662","195333495584321514617490635475521691395","264479750749213260472730304605833443850","251224371766184079981766064168826898112","39681718987685451413302644161348987020","306591882004412172043897812544507701196","184586940714455164170626214793055235645","225535752505550988208604662343482693205","186304888727167792546543748773403985673","267583222670584456445189804748637348059","312368730884693564382226980481615049741","41889211057231649460008223450122831976","51531198988979421224952243532283853268","26218469403627074921444089484671283641","101788498319277498070741377090110462617","114885644006148405884751726793148785169","61278427107303769730745179092561770182","43857854357345764387203706083705176487"],"threshold":0.9},"id":"CVE-2025-15661-8f81066e","signature_type":"Line","signature_version":"v1","source":"https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d","target":{"file":"src/sftp.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}