CVE-2025-15661: libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c
Last updated 30 June 2026
Other sources
libssh2 - Heap Buffer Over-read via sftpsymlink() in sftp.c
— Microsoft
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftpsymlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSHFXPNAME response. Attackers can supply a linklen value larger than the actual packet data in SSHFXPNAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to targetlen minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-1+deb13u1Fixed in 1.11.1-4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.1-4 - Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Fixed in 1.11.1Patch 2dae302 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2dae302 - Compensating control
If feasible, restrict or authenticate SSH/SFTP connections to trusted servers only to reduce exposure to a malicious SSH server or man-in-the-middle attacker sending crafted SSH_FXP_NAME responses.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15661?
CVE-2025-15661 has a medium severity rating of 6.5.
What is the risk level of CVE-2025-15661?
CVE-2025-15661 has a risk level of 45.
How do I fix CVE-2025-15661?
To fix CVE-2025-15661, you should update libssh2 to version 1.11.2 or later.
What kind of vulnerability is CVE-2025-15661?
CVE-2025-15661 is a heap buffer over-read vulnerability in the sftp_symlink() function.
Who can exploit CVE-2025-15661?
CVE-2025-15661 can be exploited by a malicious SSH server or a man-in-the-middle attacker.