CVE-2025-4878: Red Hat Enterprise Linux 10

Low severity, CVSS 3.6. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 6
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9: before 0:0.10.4-18.el9 (fixed in 0:0.10.4-18.el9)
• Red Hat Red Hat Openshift Container Platform 4

Published 2025-07-22. Last modified 2026-09-01.