CVE-2025-11624 is a critical severity stack buffer overwrite (CVSS 9.8) in wolfSSH. A malicious SFTP packet with a handle size larger than the system handle size, but under the allowed maximum, can overwrite stack memory on the server. The fix is in pull request 834, so upgrade to a release that includes it.
What's affected
The record describes a potential stack buffer overwrite on the SFTP server side of wolfSSH. It happens when the server receives a malicious packet whose handle size is larger than the system handle or file descriptor size, yet smaller than the maximum handle size the code allows. It is classed under CWE-787 (Out-of-bounds Write).
Only builds that run the wolfSSH SFTP server are in scope. If you use wolfSSH only as a client, or you do not enable SFTP, the described path is not part of your deployment, though you should still plan the upgrade.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: a network attack, low complexity, no privileges, no user interaction. The NVD score is 9.8.
The record links one reference, the wolfSSH pull request 834, titled "additional sanity checks on SFTP handle size". The GitHub page shows that it was merged on 1 October 2025. The pages I fetched do not state a release number that contains the change, so check the wolfSSH release notes for the first version that includes it.
How to check if you're exposed
Work out whether wolfSSH is in your products, and whether the SFTP server is enabled. Embedded and device firmware are the usual places, so ask your vendors as well as checking your own code.
For a source build, look at the version in your tree and confirm whether the merged change is present:
git -C wolfssh log --oneline | grep -i "sanity checks on SFTP handle size"
git -C wolfssh describe --tags
If your package manager ships wolfSSH, query it for the installed version, and compare with the release notes. For products from other vendors, check their security advisories for wolfSSH, since you may not see the library at all.
An SBOM makes this easier, because it records the library name and version for each build. The free in-browser scan at gold.safeguard.sh/scan can read a dependency manifest and show known issues in what it finds.
What to do now
-
Inventory every product and build that includes wolfSSH, and note which ones enable the SFTP server.
-
Update to a wolfSSH release that includes the change from pull request 834. Confirm the exact version in the release notes, because the pages I fetched did not state it.
-
If you cannot update yet, disable the SFTP server, or restrict who can reach the SSH port to trusted networks.
-
Rebuild and redeploy firmware that statically links the library, since replacing a shared library does not help there.
-
Ask device vendors whether their products embed wolfSSH and when a fixed firmware ships.
-
Add the library to your SBOM and your watch list so the next advisory reaches you quickly.
Why it matters
This is an out of bounds write on the stack, tracked as CWE-787 (Out-of-bounds Write). When a length from the network is not compared with the size of the buffer that holds the data, the program can write past the end. Stack overwrites can crash the service or, depending on the build and protections, change how it runs.
wolfSSH is a compact SSH library used in embedded systems and appliances. Those products are often slow to update, and the library is invisible to the owner. That is why a critical memory bug here can linger. The fix, per the pull request title, is an extra sanity check on handle size, a short change with a clear purpose.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog, and the pages I fetched do not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect SSH clients?
The record describes the SFTP server side. If you only use wolfSSH as a client, this described path does not apply. A separate CVE covers a client issue.
Which version fixes it?
The pages I fetched show the fix merged on 1 October 2025 but do not name a release. Check the wolfSSH release notes and advisory for the first version that includes pull request 834.
Sources
- CVE-2025-11624 on Safeguard Gold
- NVD record for CVE-2025-11624
- wolfSSH pull request 834, additional sanity checks on SFTP handle size
Last reviewed: 19 October 2026.
