CVE-2025-4878CWE-416

CVE-2025-4878

Low · published July 22, 2025

CVSS v3.1
3.6
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00212 · 10.9th percentile
Weakness
CWE-416 · Use After Free
Published
2025-07-22T19:15Z
References (6)
https://access.redhat.com/errata/RHSA-2026:18683 · [email protected]https://access.redhat.com/security/cve/CVE-2025-4878 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2376184 · [email protected]https://git.libssh.org/projects/libssh.git/commit/?id=697650caa97eaf7623924c75f9fcfec6dd423cd1 · [email protected]https://git.libssh.org/projects/libssh.git/commit/?id=b35ee876adc92a208d47194772e99f9c71e0bedb · [email protected]https://www.libssh.org/security/advisories/CVE-2025-4878.txt · [email protected]
EPSS history
Timeline
  • 22 JUL 14:17Z
    Libssh: use of uninitialized variable in privatekey_from_file()
    cvelistv5