This vulnerability resides in the SFTP Extension Name Handler of libssh, specifically in the functions sftp_extensions_get_name and sftp_extensions_get_data. It allows an attacker to cause an out-of-bounds read by manipulating the index argument, potentially leaking arbitrary memory contents. The issue is not a code‑execution flaw but can expose sensitive data stored in the process’s memory, such as credentials or encryption keys, thereby compromising confidentiality.

All installations of libssh up to and including version 0.11.3 are affected. Versions 0.11.4 and 0.12.0 include the fixed commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. The library is used by a variety of applications that provide SFTP services, so any deployment that employs the vulnerable libssh library is at risk.

The CVSS v3.1 score of 6.9 signifies a moderate severity, and the EPSS score of <1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attack requires remote access to the SFTP service and the ability to send crafted requests that trigger the out-of-bounds read. If an attacker achieves successful exploitation, they could read arbitrary data from the server’s memory, leading to information disclosure. Because the flaw is in an out-of-bounds read rather than a remote code‑execution vector, immediate exploitation is unlikely, but the impact on confidentiality should still be mitigated.