This vulnerability in libssh arises from the use of an uninitialized variable in the privatekey_from_file() function when the specified file is missing. This can lead to potential signing failures or heap corruption. The issue is documented under CVE-2025-4878 with a CVSS v3.1 base score of 3.6 (low severity). Red Hat has released security updates for libssh in Red Hat Enterprise Linux 9 that address this and other related vulnerabilities. The vendor advisory confirms the availability of patches and provides detailed remediation instructions.

The vulnerability may cause signing failures or heap corruption when libssh attempts to process a non-existent file in the privatekey_from_file() function. This could affect applications relying on libssh for SSH key handling, potentially leading to application instability or failure in cryptographic operations. The CVSS score indicates limited confidentiality and integrity impact with no availability impact. There are no known exploits in the wild.

Red Hat has released security updates that fix this vulnerability as part of libssh package updates for Red Hat Enterprise Linux 9. Users should apply the official patches provided in Red Hat Security Advisory RHSA-2026:18683. Refer to the vendor advisory at https://access.redhat.com/security/cve/CVE-2025-4878 and https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation is required beyond applying the vendor-provided fix.