===========================================================
== Subject:     Likely read beyond bounds in sftp server handle management
==
== CVE ID#:     CVE-2025-5318
==
== Versions:    All libssh versions
==
== Summary:     sftp_handle() (sftpserver) can read beyond
==              bounds
==
===========================================================

===========
Description
===========

An incorrect comparison check allows to read beyond bounds in the sftp_handle()
in the sftp server implementation. Thus an invalid pointer is returned as the
handle and we try to continue using that.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.11.2 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C (4.9)

==========
Workaround
==========
None

=======
Credits
=======

Originally reported by Ronald Crane (Hackerone: tdp3kel9g) via Zippenhop LLC
Patches provided by Jakub Jelen from the libssh team.

==========================================================
== The libssh team
==========================================================