CVE-2026-15370 is a stack-based buffer overflow vulnerability in libssh affecting the SFTP server's directory listing functionality. Specifically, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client requests directory listings containing sufficiently long attacker-controlled filenames, this can overflow the stack buffer, potentially leading to server crashes or arbitrary code execution. The vulnerability is tracked under CWE-121. Red Hat has released updated libssh RPMs (version 0.12.2-1.hum1) for affected architectures to address this issue.

The vulnerability can cause denial of service via server crashes and may allow an attacker to execute arbitrary code on the server, compromising confidentiality, integrity, and availability. The CVSS scores from various sources indicate a medium severity with high impact on confidentiality, integrity, and availability. Exploitation requires local access with low privileges and user interaction. No known exploits are reported in the wild.

A fixed update is available from Red Hat for the libssh packages included in Red Hat Hardened Images (libssh-0.12.2-1.hum1 and related RPMs). Users should apply this update to remediate the vulnerability. No workaround or temporary mitigation is available. Refer to Red Hat advisory RHSA-2026:47768 and https://images.redhat.com/ for update instructions.