BaseFortify

Publication date: 2025-10-21

Last updated on: 2025-12-04

Assigner: wolfSSL Inc.

Description

Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system handle or file descriptor size, but smaller than max handle size allowed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-21

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-10-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11624

Affected Vendors & Products

Vendor	Product	Version / Range
wolfssh	wolfssh	From 1.3.0 (inc) to 1.4.20 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a potential stack buffer overwrite on the SFTP server side. It occurs when the server receives a malicious packet containing a handle size that is larger than the system's handle or file descriptor size but smaller than the maximum allowed handle size. This mismatch can lead to overwriting parts of the stack, potentially causing unexpected behavior or crashes.

Impact Analysis

The vulnerability can lead to a stack buffer overwrite, which may cause the SFTP server to behave unpredictably, crash, or potentially be exploited to execute arbitrary code. This could result in denial of service or unauthorized actions on the affected system.

Hi! I’m here to help you understand CVE-2025-11624. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70