Loading vulnerability…
CVE-2025-15661 is a heap out-of-bounds read vulnerability in libssh2 through version 1.11.1. The sftp_symlink() function processes SSH_FXP_NAME responses to SFTP READLINK and REALPATH operations without validating the available packet buffer size before memcpy(). A malicious SSH server or man-in-the-middle attacker can supply a link_len larger than the available packet data, triggering a heap buffer over-read of up to target_len minus one bytes. Exploitation can disclose client heap memory or crash the client. Commit 2dae302 fixes the vulnerability.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An SFTP heap-buffer over-read affecting READLINK and REALPATH operations. An attacker-controlled link length exceeding the available response data reaches memcpy without adequate bounds validation, potentially disclosing heap memory or crashing the client. Fixed in commit 2dae302. The plugin identifies this CVE as its CVSS v3 score source and includes an E:P exploit-maturity indicator.
An out-of-bounds heap read in libssh2's sftp_symlink() function. A malicious SSH server or man-in-the-middle attacker can supply an excessive link_len to disclose heap memory or crash the client. Fixed in commit 2dae302.
Insufficient validation of SFTP READLINK and REALPATH responses permits a server-controlled link length to trigger a heap buffer over-read. A malicious SSH server or man-in-the-middle attacker can disclose heap contents or crash the client. Fixed in commit 2dae302.
Missing packet-length validation in sftp_symlink() allows a malicious SSH server or man-in-the-middle attacker to trigger a heap buffer over-read, disclose heap contents, or crash a client. Fixed in commit 2dae302; updated EulerOS packages are available. The accompanying CVSS v3 temporal vector indicates proof-of-concept exploit maturity.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.