CVE-2025-15382 | THREATINT

Description

A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte.

PUBLISHED Reserved 2025-12-30 | Published 2026-01-06 | Updated 2026-01-06 | Assigner wolfSSL

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-125: Out-of-bounds Read

Product status

Default status

unaffected

1.4.12 (semver) before 1.4.21

affected

Credits

Luigino Camastra finder

References

github.com/wolfSSL/wolfssh/pull/859

cve.org (CVE-2025-15382)

nvd.nist.gov (CVE-2025-15382)

Download JSON