CVE-2025-4877

Date: August 20, 2025

In libssh before 0.11.2 bin_to_base64() (src/base64.c) can experience an integer overflow and subsequent under allocation, leading to a write beyond bounds. The bug can occur only in 32-bit builds. The only problematic use case is ssh_get_fingerprint_hash() in case the API is (mis)used and a libssh consumer passes in an unexpectedly large input buffer. As a mitigation, the function bin_to_base64() is adjusted to not allow inputs larger than 256MB, which is aligned with other functions that process user input