CVE-2025-47914

MediumCVSS 5.3

Published: 19/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

42th percentile - higher than 42% of all known CVEs

Summary

SSH Agent servers do not validate message size when processing new identity requests. A malformed message may cause an out-of-bounds read and panic the program.

Risk Assessment

An attacker could remotely crash the SSH Agent service, causing denial of authentication functionality.

Recommendation

Update the SSH Agent library to a version that includes the message size validation fix.

Other vulnerabilities in SSH Agent

CVE-1999-0013High
CVE-1999-0013 vulnerability involves stolen credentials from SSH clients via the ssh-agent program, allowing other local users to access remote accounts belonging to the ssh-agent user.

Original NVD description (English source)

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS