CVE-2026-3731 is an out-of-bounds read vulnerability in libssh's SFTP extension name handler functions sftp_extensions_get_name and sftp_extensions_get_data. By manipulating the index argument, a remote attacker can cause the application to read memory outside the intended buffer, potentially leading to denial of service or information disclosure. This vulnerability affects Red Hat Enterprise Linux versions that include libssh. The Red Hat advisory RHSA-2026:7067 covers this and related CVEs but currently does not provide a fix or effective mitigation. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and has a moderate impact rating by Red Hat. No known exploits in the wild have been reported.

The vulnerability allows a remote attacker to cause a denial of service by crashing the affected system or potentially disclose sensitive information by reading out-of-bounds memory. This could include cryptographic keys or other sensitive data, which might aid in further attacks. The impact is rated moderate by Red Hat, with no confirmed active exploitation. The flaw affects availability and confidentiality but not integrity.

Currently, no mitigation or patch meets Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates and apply fixes once available. Red Hat recommends upgrading to fixed versions when released. No immediate workaround is provided by Red Hat.