The vulnerability identified as CVE-2025-47914 affects the golang.org/x/crypto/ssh/agent package. It stems from improper validation of message sizes during the processing of new identity requests by SSH Agent servers. Specifically, the lack of size checks can lead to out of bounds reads, causing the program to panic. The issue is categorized under CWE-237 (Incorrect Comparison) and CWE-125 (Out-of-bounds Read). The CVSS v3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (program crash). There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation of this vulnerability results in a denial of service condition where the SSH Agent server may panic and crash due to out of bounds memory access when handling malformed new identity request messages. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider minimizing exposure of the SSH Agent service to untrusted networks or inputs to reduce the risk of denial of service.