# CVE-2025-5318: Libssh: out-of-bounds read in sftp_handle()

CVE-2025-5318 is fixed in 7 products on 1 platform, first by RHSA-2025:21013, released June 24, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-5318
- Priority: Routine
- CVSS: 5.4 (Moderate)
- EPSS: 0.0189
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 24, 2025
- Weakness: Out-of-bounds Read
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5318

## Description

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libssh Debian 12.15 (bookworm) | 0.10.6-0+deb12u2 | [DEBIAN-CVE-2025-5318](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5318.md) | Jun 24, 2025 |
| Linux | libssh Debian 13.5 (trixie) | 0.11.2-1 | [DEBIAN-CVE-2025-5318](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5318.md) | Jun 24, 2025 |
| Linux | libssh Debian 14 | 0.11.2-1 | [DEBIAN-CVE-2025-5318](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5318.md) | Jun 24, 2025 |
| Linux | libssh RHEL 10 | 0.11.1-4.el10_1 | [RHSA-2025:21013](https://patchblox.com/security/data/fix/linux/rhsa-2025-21013.md) | Jun 24, 2025 |
| Linux | libssh RHEL 8 | 0:0.9.6-15.el8_10 | [RHSA-2025:18286](https://patchblox.com/security/data/fix/linux/rhsa-2025-18286.md) | Oct 20, 2025 |
| Linux | libssh RHEL 9 | 0:0.10.4-15.el9_7 | [RHSA-2025:20943](https://patchblox.com/security/data/fix/linux/rhsa-2025-20943.md) | Nov 11, 2025 |
| Linux | libssh almalinux 10 | 0.11.1-4.el10_1 | [ALSA-2025:21013](https://patchblox.com/security/data/fix/linux/alsa-2025-21013.md) | Nov 11, 2025 |
| Linux | libssh almalinux 8 | 0.9.6-15.el8_10 | [ALSA-2025:18286](https://patchblox.com/security/data/fix/linux/alsa-2025-18286.md) | Oct 20, 2025 |
| Linux | libssh almalinux 9 | 0.10.4-15.el9_7 | [ALSA-2025:20943](https://patchblox.com/security/data/fix/linux/alsa-2025-20943.md) | Nov 11, 2025 |
| Linux | libssh amzn 2023 | 0.10.6-1.amzn2023.0.2 | [ALAS2023-2025-1155](https://patchblox.com/security/data/fix/linux/alas2023-2025-1155.md) | Aug 18, 2025 |
| Linux | libssh ol 10 | 0:0.11.1-4.el10_0 | [ELSA-2025-18231](https://patchblox.com/security/data/fix/linux/elsa-2025-18231.md) | Oct 16, 2025 |
| Linux | libssh ol 8 | 0:0.9.6-15.el8_10 | [ELSA-2025-18286](https://patchblox.com/security/data/fix/linux/elsa-2025-18286.md) | Oct 19, 2025 |
| Linux | libssh ol 9 | 0:0.10.4-15.el9_6 | [ELSA-2025-18275](https://patchblox.com/security/data/fix/linux/elsa-2025-18275.md) | Oct 16, 2025 |
| Linux | libssh opensuse-leap 15.6 | 0.9.8-150600.11.3.1 | [SUSE-SU-2025:02229-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02229-1.md) | Jul 4, 2025 |
| Linux | libssh rocky 10 | 0:0.11.1-4.el10_0 | [RLSA-2025:18231](https://patchblox.com/security/data/fix/linux/rlsa-2025-18231.md) | Oct 18, 2025 |
| Linux | libssh rocky 8 | 0:0.9.6-15.el8_10 | [RLSA-2025:18286](https://patchblox.com/security/data/fix/linux/rlsa-2025-18286.md) | Nov 28, 2025 |
| Linux | libssh rocky 9 | 0:0.10.4-15.el9_6 | [RLSA-2025:20943](https://patchblox.com/security/data/fix/linux/rlsa-2025-20943.md) | Nov 12, 2025 |
| Linux | libssh sles 15.6 | 0.9.8-150600.11.3.1 | [SUSE-SU-2025:02229-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02229-1.md) | Jul 4, 2025 |
| Linux | libssh sles 15.7 | 0.9.8-150600.11.3.1 | [SUSE-SU-2025:02229-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02229-1.md) | Jul 4, 2025 |
| Linux | libssh-4 Ubuntu 18.04.6 LTS (bionic) | 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4 | [libssh-4 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssh-4-0.8.0-20170825.94fa1e38-1ubuntu0.7-esm4.md) | Jun 24, 2025 |
| Linux | libssh-4 Ubuntu 20.04 LTS (focal) | 0.9.3-2ubuntu2.5+esm1 | [libssh-4 0.9.3-2ubuntu2.5+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libssh-4-0.9.3-2ubuntu2.5-esm1.md) | Jun 24, 2025 |
| Linux | libssh-4 Ubuntu 22.04.1 LTS (jammy) | 0.9.6-2ubuntu0.22.04.4 | [libssh-4 0.9.6-2ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssh-4-0.9.6-2ubuntu0.22.04.4.md) | Jun 24, 2025 |
| Linux | libssh-4 Ubuntu 24.04.5 LTS (noble) | 0.10.6-2ubuntu0.1 | [libssh-4 0.10.6-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssh-4-0.10.6-2ubuntu0.1.md) | Jun 24, 2025 |
| Linux | libssh-4 Ubuntu 24.10 (oracular) | 0.10.6-3ubuntu1.1 | [libssh-4 0.10.6-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libssh-4-0.10.6-3ubuntu1.1.md) | Jun 25, 2025 |
| Linux | libssh-4 Ubuntu 25.04 (plucky) | 0.11.1-1ubuntu0.1 | [libssh-4 0.11.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libssh-4-0.11.1-1ubuntu0.1.md) | Jun 25, 2025 |
| Linux | libssh-config RHEL 8 | 0:0.9.6-15.el8_10 | [RHSA-2025:18286](https://patchblox.com/security/data/fix/linux/rhsa-2025-18286.md) | Oct 20, 2025 |
| Linux | libssh-config RHEL 9 | 0:0.10.4-15.el9_7 | [RHSA-2025:20943](https://patchblox.com/security/data/fix/linux/rhsa-2025-20943.md) | Nov 11, 2025 |
| Linux | libssh-config almalinux 10 | 0.11.1-4.el10_1 | [ALSA-2025:21013](https://patchblox.com/security/data/fix/linux/alsa-2025-21013.md) | Nov 11, 2025 |
| Linux | libssh-config almalinux 8 | 0.9.6-15.el8_10 | [ALSA-2025:18286](https://patchblox.com/security/data/fix/linux/alsa-2025-18286.md) | Oct 20, 2025 |
| Linux | libssh-config almalinux 9 | 0.10.4-15.el9_7 | [ALSA-2025:20943](https://patchblox.com/security/data/fix/linux/alsa-2025-20943.md) | Nov 11, 2025 |
| Linux | libssh-config amzn 2023 | 0.10.6-1.amzn2023.0.2 | [ALAS2023-2025-1155](https://patchblox.com/security/data/fix/linux/alas2023-2025-1155.md) | Aug 18, 2025 |
| Linux | libssh-config ol 10 | 0:0.11.1-4.el10_0 | [ELSA-2025-18231](https://patchblox.com/security/data/fix/linux/elsa-2025-18231.md) | Oct 16, 2025 |
| Linux | libssh-config ol 8 | 0:0.9.6-15.el8_10 | [ELSA-2025-18286](https://patchblox.com/security/data/fix/linux/elsa-2025-18286.md) | Oct 19, 2025 |
| Linux | libssh-config ol 9 | 0:0.10.4-15.el9_6 | [ELSA-2025-18275](https://patchblox.com/security/data/fix/linux/elsa-2025-18275.md) | Oct 16, 2025 |
| Linux | libssh-debuginfo amzn 2023 | 0.10.6-1.amzn2023.0.2 | [ALAS2023-2025-1155](https://patchblox.com/security/data/fix/linux/alas2023-2025-1155.md) | Aug 18, 2025 |
| Linux | libssh-debugsource amzn 2023 | 0.10.6-1.amzn2023.0.2 | [ALAS2023-2025-1155](https://patchblox.com/security/data/fix/linux/alas2023-2025-1155.md) | Aug 18, 2025 |
| Linux | libssh-devel RHEL 8 | 0:0.9.6-15.el8_10 | [RHSA-2025:18286](https://patchblox.com/security/data/fix/linux/rhsa-2025-18286.md) | Oct 20, 2025 |
| Linux | libssh-devel RHEL 9 | 0:0.10.4-15.el9_7 | [RHSA-2025:20943](https://patchblox.com/security/data/fix/linux/rhsa-2025-20943.md) | Nov 11, 2025 |
| Linux | libssh-devel almalinux 10 | 0.11.1-4.el10_1 | [ALSA-2025:21013](https://patchblox.com/security/data/fix/linux/alsa-2025-21013.md) | Nov 11, 2025 |
| Linux | libssh-devel almalinux 8 | 0.9.6-15.el8_10 | [ALSA-2025:18286](https://patchblox.com/security/data/fix/linux/alsa-2025-18286.md) | Oct 20, 2025 |
| Linux | libssh-devel almalinux 9 | 0.10.4-15.el9_7 | [ALSA-2025:20943](https://patchblox.com/security/data/fix/linux/alsa-2025-20943.md) | Nov 11, 2025 |
| Linux | libssh-devel amzn 2023 | 0.10.6-1.amzn2023.0.2 | [ALAS2023-2025-1155](https://patchblox.com/security/data/fix/linux/alas2023-2025-1155.md) | Aug 18, 2025 |
| Linux | libssh-devel ol 10 | 0:0.11.1-4.el10_0 | [ELSA-2025-18231](https://patchblox.com/security/data/fix/linux/elsa-2025-18231.md) | Oct 16, 2025 |
| Linux | libssh-devel ol 8 | 0:0.9.6-15.el8_10 | [ELSA-2025-18286](https://patchblox.com/security/data/fix/linux/elsa-2025-18286.md) | Oct 19, 2025 |
| Linux | libssh-devel ol 9 | 0:0.10.4-15.el9_6 | [ELSA-2025-18275](https://patchblox.com/security/data/fix/linux/elsa-2025-18275.md) | Oct 16, 2025 |
| Linux | libssh-gcrypt-4 Ubuntu 18.04.6 LTS (bionic) | 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4 | [libssh-gcrypt-4 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssh-gcrypt-4-0.8.0-20170825.94fa1e38-1ubuntu0.7-esm4.md) | Jun 24, 2025 |
| Linux | libssh-gcrypt-4 Ubuntu 20.04 LTS (focal) | 0.9.3-2ubuntu2.5+esm1 | [libssh-gcrypt-4 0.9.3-2ubuntu2.5+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libssh-gcrypt-4-0.9.3-2ubuntu2.5-esm1.md) | Jun 24, 2025 |
| Linux | libssh-gcrypt-4 Ubuntu 22.04.1 LTS (jammy) | 0.9.6-2ubuntu0.22.04.4 | [libssh-gcrypt-4 0.9.6-2ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssh-gcrypt-4-0.9.6-2ubuntu0.22.04.4.md) | Jun 24, 2025 |
| Linux | libssh-gcrypt-4 Ubuntu 24.04.5 LTS (noble) | 0.10.6-2ubuntu0.1 | [libssh-gcrypt-4 0.10.6-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssh-gcrypt-4-0.10.6-2ubuntu0.1.md) | Jun 24, 2025 |
| Linux | libssh-gcrypt-4 Ubuntu 24.10 (oracular) | 0.10.6-3ubuntu1.1 | [libssh-gcrypt-4 0.10.6-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libssh-gcrypt-4-0.10.6-3ubuntu1.1.md) | Jun 25, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.