This vulnerability arises from an integer overflow or wraparound in the SFTP server message decoding logic of libssh version 0.11.0. The flaw is due to an incorrect check of packet length, which allows an attacker to trigger an overflow when handling large payload sizes on 32-bit architectures. This overflow results in failed memory allocation attempts and causes the server process to crash, leading to a denial of service condition. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring low privileges, no user interaction, and impacting availability only.

Successful exploitation causes the libssh SFTP server process to crash, resulting in denial of service. There is no confidentiality or integrity impact reported. The vulnerability specifically affects 32-bit systems due to integer overflow in packet length handling.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-5449 for current remediation guidance. No explicit patch or workaround information is provided in the available data. Users should monitor the vendor advisory for updates and apply official fixes once available.