Cyber Posture

CVE-2025-15382

High

Published: 06 January 2026

Published
06 January 2026
Modified
12 January 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS Score 0.0020 42.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the vulnerability by requiring timely application of the available wolfSSL wolfssh patch for the heap buffer over-read in wolfSSH_CleanPath().

SI-16 Memory Protection good match
prevent

Implements memory protection safeguards such as bounds checking and heap isolation to prevent exploitation of the one-byte heap over-read triggered by crafted SCP paths.

SI-10 Information Input Validation partial match
prevent

Requires validation of SCP path inputs to reject or sanitize crafted '/./' sequences before they reach the vulnerable wolfSSH_CleanPath() function.

Security SummaryAI

CVE-2025-15382 is a heap buffer over-read vulnerability in the wolfSSH_CleanPath() function within the wolfSSH library. The issue arises when processing crafted SCP path input containing '/./' sequences, leading to a one-byte heap over-read. It affects wolfSSH implementations that handle SCP operations.

An authenticated remote attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Successful exploitation results in high confidentiality (C:H) and availability (A:H) impacts, but no integrity impact (I:N), under an unchanged scope (S:U), as reflected in its CVSS v3.1 base score of 8.1. The attacker can trigger the over-read to potentially disclose sensitive heap memory contents or cause denial-of-service.

Mitigation is addressed in a patch available via the wolfSSL wolfssh GitHub pull request #859, which security practitioners should review and apply to affected versions.

Details

CWE(s)
CWE-125

Affected Products

wolfssh
wolfssh
1.4.12 — 1.4.22

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a remotely exploitable heap buffer over-read in wolfSSH SCP path handling, directly enabling exploitation of a remote service (SSH/SCP) for memory disclosure or DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References