---
id: CVE-2025-4878
title: >-
  A vulnerability was found in libssh, where an uninitialized variable exists
  under certain conditions in the privatekey_from_file() function
summary: >-
  A vulnerability was found in libssh, where an uninitialized variable exists
  under certain conditions in the privatekey_from_file() function. This flaw can
  be triggered if the file specified by the filename doesn't exist and may lead
  to p…
severity: low
cvss: 3.6
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-416
published: '2025-07-22'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-4878'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:18683'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2025-4878'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2376184'
    label: secalert@redhat.com
  - url: >-
      https://git.libssh.org/projects/libssh.git/commit/?id=697650caa97eaf7623924c75f9fcfec6dd423cd1
    label: secalert@redhat.com
  - url: >-
      https://git.libssh.org/projects/libssh.git/commit/?id=b35ee876adc92a208d47194772e99f9c71e0bedb
    label: secalert@redhat.com
  - url: 'https://www.libssh.org/security/advisories/CVE-2025-4878.txt'
    label: secalert@redhat.com
tags:
  - nvd
epss: 0.00186
epssPercentile: 0.07252
ingestedAt: '2026-06-29T13:24:34.396Z'
---

## Overview

A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.