Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2025-15382

Client SCP Request Triggers Buffer Overread by 1 Byte

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
wolfSSL

Description

A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

wolfSSL wolfSSH

Default version status: unaffected

  • 1.4.12 to < 1.4.21affected

References