7.3
CVE-2026-15370
- EPSS 0.16%
- Veröffentlicht 21.07.2026 09:16:53
- Zuletzt bearbeitet 17.08.2026 22:16:59
- CVE-Watchlists
- Unerledigt
Libssh: libssh: stack buffer overflow in sftp server longname construction
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.056 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.3 | 1.3 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
| RedHat | 6.7 | 0.8 | 5.9 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
|
CWE-121 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
https://access.redhat.com/security/cve/CVE-2026-15370
https://bugzilla.redhat.com/show_bug.cgi?id=2499049
https://access.redhat.com/errata/RHSA-2026:47768
https://access.redhat.com/errata/RHSA-2026:55855