In OpenSSH before 10.5, a use‑after‑free flaw occurs during realloc operations when two particular remote‑forwarding commands are issued concurrently. The bug can corrupt data structures or cause the SSH client to crash. The official description does not affirm that arbitrary code execution is possible, so the impact is limited to memory corruption and instability, potentially exposing sensitive data if the client processes untrusted input during a crash scenario. The CWE identifiers associated with the weakness are CWE‑416 (Use‑after‑free) and CWE‑825 (Data Corruption through Incorrectly Managed Reference).

Any OpenSSH installation from OpenBSD prior to release 10.5 is susceptible, because the code change that removes the realloc bug is only present in that version. No additional sub‑release details are provided, so all pre‑10.5 releases should be treated as vulnerable.

The CVSS score of 4.8 indicates moderate severity, while an EPSS score of less than 1 % suggests a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in CISA KEV. Exploitation requires a remote SSH session that initiates two forwarding operations simultaneously; the scenario that can be engineered from the network side is inferred from the description. The effect is confined to the client running the vulnerable code, potentially resulting in a crash or memory corruption but not in code execution or broader system compromise.