Based on the description, the special string 'none' is intended to disable a feature but is sometimes parsed as a filename. This misinterpretation can cause sshd to attempt to open or read a file that was intended to be treated as a disabled indicator, potentially leading to the server process accessing unintended data. Consequently, data from unexpected files may be read by sshd and possibly exposed to users who can influence the configuration.

OpenBSD OpenSSH servers running any version earlier than 10.6 are impacted. The advisory references the OpenBSD distribution; all releases newer than 10.6 contain the fix.

The CVSS score of 3.6 places this issue in the low severity range. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or privileged access to the sshd configuration, as the flaw requires the attacker to modify configuration files or provide a custom configuration at startup.