Description
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
Affected products
openbsd: openssh; fedoraproject: fedora; netapp: ontap select deploy administration utility; netapp: a250 firmware; netapp: a250; netapp: 500f firmware; netapp: 500f; netapp: c250 firmware; netapp: c250
References10
- ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.s… PatchVendor Advisory
- ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.s… PatchVendor Advisory
- github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663… PatchThird Party Advisory
- github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663… PatchThird Party Advisory
- bugzilla.mindrot.org/show_bug.cgi?id=3522 ExploitIssue TrackingThird Party Advisory
- jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writ… ExploitThird Party Advisory
- www.openwall.com/lists/oss-security/2023/02/02/2 ExploitMailing ListThird Party Advisory
- bugzilla.mindrot.org/show_bug.cgi?id=3522 ExploitIssue TrackingThird Party Advisory
- jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writ… ExploitThird Party Advisory
- www.openwall.com/lists/oss-security/2023/02/02/2 ExploitMailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - EPSS — exploit probability
- 90% percentile: 100 · as of 6 November 2026
- CWE
- CWE-415
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.