A heap buffer over-read vulnerability exists in libssh2 through version 1.11.1_3 in the sftp_symlink() function. This flaw allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response with an invalid link_len value. The issue is fixed in version 1.11.1_3.