An out-of-bounds read vulnerability exists in the libssh library in versions before 0.11.2. The flaw occurs in the sftp_handle function where an incorrect comparison check permits access to memory beyond the valid handle list, returning an invalid pointer used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, which may expose sensitive information or impact service behavior. Red Hat has released security updates for affected Red Hat Enterprise Linux 9 and 10 versions to fix this issue.

The vulnerability allows an authenticated remote attacker to read memory outside the intended bounds, potentially exposing sensitive information or causing unexpected service behavior. The CVSS v3.1 base score is 5.4 (medium severity), reflecting limited confidentiality and integrity impact without availability impact. No known exploits in the wild have been reported.

Official patches are available from Red Hat for affected libssh versions in Red Hat Enterprise Linux 9 and 10. Users should apply the updated libssh packages as described in Red Hat advisories RHSA-2025:18231 and RHSA-2025:18275. For detailed update instructions, refer to https://access.redhat.com/articles/11258. Applying these updates fully mitigates the vulnerability.