Russh’s CryptoVec performs unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths for its internal buffers. The bug allows attacker-controlled frame lengths to be used in buffer growth before validation, exposing the library to buffer overflows or other memory corruption issues. This is captured by CWE‑770. Based on the description, the impact could potentially result in denial of service or possibly arbitrary code execution if the corruption is leveraged in a larger attack context.

The vulnerability affects the Rust SSH client and server library published by Eugeny, named russh. Any release prior to 0.60.3 is affected when local SSH agent peers provide inputs, while versions before 0.58.0 also expose the flaw to remote SSH traffic through transport and compression buffers.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is not available, so the exact likelihood of exploitation cannot be quantified, but the bug is listed outside the CISA KEV catalog. Attackers who can reach the local SSH agent inputs may exploit the unchecked buffer growth, and remote attackers can trigger the flaw against older releases via normal SSH traffic. Based on the description, the potential impact is likely significant for systems employing older russh versions.