A flaw in libssh2’s userauth_password routine can cause an integer overflow when processing the username or password length fields. This overflow may corrupt internal buffers, giving an attacker the possibility to disrupt authentication logic or trigger further exploitation. The vulnerability is limited to the authentication phase and does not directly grant code execution but can be a stepping stone to more severe outcomes.

The libssh2 library, versions up to 1.11.1, is affected. Applications or services that embed this library for SSH client or server functionality could be vulnerable.

The CVSS score of 6.9 indicates a moderate severity for this issue. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no documented exploits at this time. The description states that the attack may be launched remotely, and it is inferred that a remote attacker could trigger the overflow by sending crafted authentication requests to an SSH service using the vulnerable libssh2 build.