A heap buffer overflow exists in the error-handling path of the BoKS SSH daemon when dealing with revoked keys. The code constructs a human‑readable failure message using sprintf() into a heap buffer that is sized too small for the formatted output. When the full message is written, data can be copied past the end of the allocated memory, corrupting the heap. This memory corruption can allow an attacker to overwrite data structures or control flow, providing a vector for arbitrary code execution or denial of service if the overflow is triggered during an authentication attempt.

The vulnerability affects Fortra’s Core Privileged Access Manager (BoKS) SSH component. No specific version information is provided, so all deployments of BoKS that include the affected sshd code are potentially vulnerable until the vendor issues a patched release.

The CVSS score of 8.1 indicates a high-severity flaw. EPSS data is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Because the overflow occurs during SSH key revocation handling, the likely attack vector is remote; an attacker could trigger the error by attempting authentication with a revoked key or by sending crafted commands if the revoked-key path is invoked externally. However, the description does not confirm exploitation of the overflow, so the impact remains theoretical until proof of concept is published.