CVE-2025-5318: vLLM OOB read — HIGH

Q: Is CVE-2025-5318 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-5318, increasing the risk of exploitation.

Q: How to fix CVE-2025-5318?

Upgrade libssh to 0.11.2 or later on any host or container image where it is present. For Red Hat AI Inference Server deployments, pull updated rhaiis/vllm-cuda-rhel9 and rhaiis/vllm-rocm-rhel9 image tags per the listed RHSA errata (RHSA-2025:18231, 18275, 18286, 19012, 19098, 19101, 19295, 19300, 19313, 19400) and redeploy. As a compensating control, restrict SSH/SFTP access on inference hosts to trusted management networks and enforce least-privilege on any accounts with SFTP access, since exploitation requires an authenticated low-privilege session. Detection: monitor for anomalous or malformed SFTP handle requests, unexpected sshd/libssh process crashes, or out-of-pattern memory-read errors in logs on hosts serving RHAIIS images.

Q: What systems are affected by CVE-2025-5318?

This vulnerability affects the following AI/ML architecture patterns: model serving, AI inference container images.

Q: What is the CVSS score for CVE-2025-5318?

CVE-2025-5318 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 1.49%.

CISO Take

This is a memory-safety bug in libssh's sftp_handle function: an incorrect comparison check lets an authenticated attacker reference a handle outside the valid list, returning an invalid pointer that gets used in further processing and can expose unintended memory or degrade service. It carries a CVSS of 8.1 (high) and sits in the top 18% of EPSS-scored vulnerabilities for exploitation likelihood, with public PoC code already circulating, though it is not in CISA KEV and CISA's own SSVC call is TRACK rather than an urgent action signal. The AI-relevant angle isn't vLLM's own logic — it's that Red Hat's AI Inference Server images (rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9) bundle libssh as a base-image dependency, and libssh itself has 129 downstream dependents and 82 other historical CVEs, so this is a supply-chain exposure riding along with the inference stack rather than a novel model-layer attack. Patch to libssh 0.11.2+ or pull the matching Red Hat errata for your RHAIIS image tags, and since exploitation requires an authenticated low-privilege session, restrict and monitor who can reach SSH/SFTP on hosts running these images.

Sources: NVD EPSS ATLAS

What is the risk?

Moderate-to-high risk in principle (CVSS 8.1, high confidentiality and availability impact) but tempered by the PR:L requirement — an attacker needs a valid low-privilege authenticated session before triggering the flaw, which meaningfully narrows the practical attack surface versus an unauthenticated remote bug. EPSS at the 18th percentile and SSVC=TRACK indicate no evidence of active mass exploitation, but the public PoC raises the probability of opportunistic weaponization once attackers have any foothold (e.g. stolen credentials, compromised service account). Because libssh underlies many services beyond AI workloads (129 dependents, 82 prior CVEs), risk should be tracked at the library/base-image level, not treated as an AI-specific threat.

How does the attack unfold?

Initial Access

Attacker obtains valid low-privilege authenticated SSH/SFTP credentials to a host or container running libssh <0.11.2, such as an RHAIIS vLLM inference image.

AML.T0012

Exploitation

Attacker sends crafted SFTP handle requests that trigger the incorrect comparison check in sftp_handle, causing an out-of-bounds read and an invalid pointer to be used in further processing.

Impact

The flaw exposes unintended memory contents (potential data leakage) or crashes the SSH/SFTP-facing process, disrupting management access to the AI inference server.

AML.T0010.001

Initial Access

Attacker obtains valid low-privilege authenticated SSH/SFTP credentials to a host or container running libssh <0.11.2, such as an RHAIIS vLLM inference image.

AML.T0012

Exploitation

Attacker sends crafted SFTP handle requests that trigger the incorrect comparison check in sftp_handle, causing an out-of-bounds read and an invalid pointer to be used in further processing.

Impact

The flaw exposes unintended memory contents (potential data leakage) or crashes the SSH/SFTP-facing process, disrupting management access to the AI inference server.

AML.T0010.001

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
88.6K 130 dependents Pushed today 26% patched ~51d to patch Full package profile →
vLLM	pip	—	No patch
88.6K 130 dependents Pushed today 26% patched ~51d to patch Full package profile →
libssh	—	—	No patch
rhaiis/model-opt-cuda-rhel9	—	—	No patch
rhcos	—	—	No patch
rhosdt/tempo-gateway-opa-rhel8	—	—	No patch
rhosdt/tempo-gateway-rhel8	—	—	No patch
rhosdt/tempo-jaeger-query-rhel8	—	—	No patch
rhosdt/tempo-query-rhel8	—	—	No patch
rhosdt/tempo-rhel8	—	—	No patch
rhosdt/tempo-rhel8-operator	—	—	No patch

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

1.5%

chance of exploitation in 30 days

Higher than 72% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A High

What should I do?

1 step

Upgrade libssh to 0.11.2 or later on any host or container image where it is present. For Red Hat AI Inference Server deployments, pull updated rhaiis/vllm-cuda-rhel9 and rhaiis/vllm-rocm-rhel9 image tags per the listed RHSA errata (RHSA-2025:18231, 18275, 18286, 19012, 19098, 19101, 19295, 19300, 19313, 19400) and redeploy. As a compensating control, restrict SSH/SFTP access on inference hosts to trusted management networks and enforce least-privilege on any accounts with SFTP access, since exploitation requires an authenticated low-privilege session. Detection: monitor for anomalous or malformed SFTP handle requests, unexpected sshd/libssh process crashes, or out-of-pattern memory-read errors in logs on hosts serving RHAIIS images.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Data Leakage DoS Inference AML.T0010.001 - AI Software

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1 - Third-party risks and dependencies are monitored and addressed

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2025-5318?

This is a memory-safety bug in libssh's sftp_handle function: an incorrect comparison check lets an authenticated attacker reference a handle outside the valid list, returning an invalid pointer that gets used in further processing and can expose unintended memory or degrade service. It carries a CVSS of 8.1 (high) and sits in the top 18% of EPSS-scored vulnerabilities for exploitation likelihood, with public PoC code already circulating, though it is not in CISA KEV and CISA's own SSVC call is TRACK rather than an urgent action signal. The AI-relevant angle isn't vLLM's own logic — it's that Red Hat's AI Inference Server images (rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9) bundle libssh as a base-image dependency, and libssh itself has 129 downstream dependents and 82 other historical CVEs, so this is a supply-chain exposure riding along with the inference stack rather than a novel model-layer attack. Patch to libssh 0.11.2+ or pull the matching Red Hat errata for your RHAIIS image tags, and since exploitation requires an authenticated low-privilege session, restrict and monitor who can reach SSH/SFTP on hosts running these images.

Is CVE-2025-5318 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-5318, increasing the risk of exploitation.

How to fix CVE-2025-5318?

Upgrade libssh to 0.11.2 or later on any host or container image where it is present. For Red Hat AI Inference Server deployments, pull updated rhaiis/vllm-cuda-rhel9 and rhaiis/vllm-rocm-rhel9 image tags per the listed RHSA errata (RHSA-2025:18231, 18275, 18286, 19012, 19098, 19101, 19295, 19300, 19313, 19400) and redeploy. As a compensating control, restrict SSH/SFTP access on inference hosts to trusted management networks and enforce least-privilege on any accounts with SFTP access, since exploitation requires an authenticated low-privilege session. Detection: monitor for anomalous or malformed SFTP handle requests, unexpected sshd/libssh process crashes, or out-of-pattern memory-read errors in logs on hosts serving RHAIIS images.

What systems are affected by CVE-2025-5318?

This vulnerability affects the following AI/ML architecture patterns: model serving, AI inference container images.

What is the CVSS score for CVE-2025-5318?

CVE-2025-5318 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 1.49%.

What is the AI security impact?

Affected AI Architectures

model servingAI inference container images

MITRE ATLAS Techniques

AML.T0010.001 AI Software

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

Exploitation Scenario

An attacker who has obtained low-privilege, authenticated SSH/SFTP credentials to a host running an RHAIIS vLLM inference image (e.g. via a phished service account, leaked API key reused for SSH, or an over-permissioned CI/CD deploy account) issues a crafted sequence of SFTP handle requests designed to trigger the faulty comparison check in sftp_handle. The out-of-bounds read returns a pointer outside the valid handle list, and the server uses it in subsequent processing, either leaking adjacent memory contents back to the attacker (potentially containing session tokens, buffered credentials, or configuration data) or crashing the sshd/libssh process and disrupting management access to the inference server. The attack does not touch the model or inference API directly but could be a stepping stone to broader host compromise or a denial-of-service against operational access to the AI serving infrastructure.

Weaknesses (CWE)

CWE-125 Out-of-bounds Read

CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use a language that provides appropriate memory abstractions.

Source: MITRE CWE corpus.