CVE-2025-4877
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
24/100
Published: 2025-08-20
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
Low
UI:
None
S:
Unchanged
C:
Low
I:
Low
A:
Low
Description
There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.
Weakness Classification (1)
References & Advisories (5)
vendor-advisory
x_refsource_REDHAT
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT