The vulnerability CVE-2025-8114 in libssh arises from a NULL pointer dereference triggered by an allocation failure in cryptographic functions during the calculation of the session ID in the key exchange (KEX) process. This flaw can cause the libssh client or server to crash, resulting in a denial of service condition. The vulnerability has a CVSS 3.1 base score of 4.7 (medium severity) with attack vector local, high attack complexity, low privileges required, no user interaction, unchanged scope, and no confidentiality or integrity impact but high availability impact. Red Hat has published security advisories and released patches for affected versions of Red Hat Enterprise Linux 9 to remediate this issue.

Exploitation of this vulnerability results in a denial of service due to a NULL pointer dereference causing the libssh client or server to crash. There is no impact on confidentiality or integrity. The attack requires local access with low privileges and has high complexity, limiting the ease of exploitation. No known exploits are reported in the wild at this time.

Red Hat has released official security updates addressing CVE-2025-8114 as part of a libssh update in Red Hat Enterprise Linux 9. Users should apply the provided patches as detailed in Red Hat advisory RHSA-2026:18683 and the referenced update article (https://access.redhat.com/articles/11258). Patch status is confirmed as available. No additional mitigation is required beyond applying the official update.