The vulnerability in libssh (CVE-2026-15370) involves a stack-based buffer overflow in the SFTP server's longname construction during directory listing. Specifically, the longname field is built by concatenating attacker-controlled filenames into a fixed-size stack buffer without proper bounds checking. This unsafe operation can cause a buffer overflow, potentially leading to denial of service via crashes or even arbitrary code execution on the server. Red Hat has issued a security advisory and released updated libssh packages (version 0.12.2-1.hum1) for their Hardened Images RPMs on aarch64 and x86_64 architectures to fix this issue. The vulnerability is rated with a CVSS v3.1 base score of approximately 6.7 to 7.3 depending on the source, with impacts on confidentiality, integrity, and availability. No workaround exists, so patching is the recommended mitigation.

Exploitation of this vulnerability can cause denial of service through server crashes or potentially allow arbitrary code execution on the affected system. This impacts the confidentiality, integrity, and availability of the affected libssh server. The vulnerability requires local access with low privileges and user interaction. The attack complexity is rated as high by Red Hat but low by other sources. The vulnerability affects the SFTP server component of libssh during directory listing operations involving attacker-controlled filenames.

Red Hat has released updated libssh packages (version 0.12.2-1.hum1) as part of their Hardened Images RPMs to address this vulnerability. There is no available workaround. Users should apply the official Red Hat update promptly to mitigate the risk. Refer to Red Hat advisory RHSA-2026:47768 for detailed update instructions. Since this is not a cloud service, remediation depends on applying the vendor-provided patch.