High severity · published Mar 8, 2026
CVE-2026-3731
libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libssh · Libssh
0.11.0; 0.11.1; 0.11.2; 0.11.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3731
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3731
Patch
https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60
Permissions Required
https://vuldb.com/?ctiid.349709
Third Party Advisory
https://vuldb.com/?id.349709
Third Party Advisory
https://vuldb.com/?submit.767120
Patch
https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz
Product
https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt
More from libssh
9.1
CVE-2018-10933
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4
8.8
CVE-2026-59851
Libssh: libssh: authentication bypass via missing gssapi principal check
8.8
CVE-2025-5372
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation
8.8
CVE-2019-14889
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8
8.2
CVE-2026-0966
Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()