ANT-2026-T6EKK5DB · openssh

heap-buffer-overflow low

Severity Claude critical · Security research firm low · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif.

ANT-2026-T6EKK5DB: heap-buffer-overflow (READ of size 1, 1 byte before allocation) in openssh

In the OpenSSH sftp client, the server's REALPATH response is stored as pwd and later passed to path_strip() during ls. A malicious SFTP server can return an empty string for REALPATH, making pwd a zero-length heap string. In path_strip(), len = strlen(strip) is 0 and strncmp(path, strip, 0) always succeeds, so the code evaluates strip[len - 1], i.e. strip[-1], reading one byte before the 1-byte allocation. The attacker controls the server responses and needs only the victim to connect and run ls. The result is a deterministic 1-byte out-of-bounds heap read.

Target

Project: openssh
Commit: fe7dffba1e470987
Location: sftp.c:377

Technical Details

ASAN: "READ of size 1 at 0x5020000000af ... 1 bytes to the left of 1-byte region". path_strip() computes len = strlen(strip) and, because strncmp(path, strip, 0) == 0 unconditionally, proceeds to check strip[len - 1] != '/' without guarding against len == 0, producing a heap-buffer-underflow read at index -1 when the server-supplied pwd is empty.

Crash trace (truncated — full trace in attached crash.log):

sftp> ls
=================================================================
==531==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5020000000af at pc 0x556696487da0 bp 0x7ffee1187580 sp 0x7ffee1187570
READ of size 1 at 0x5020000000af thread T0
    #0 0x556696487d9f in path_strip /workspace/repo/sftp.c:377
    #1 0x55669648ac77 in do_ls_dir /workspace/repo/sftp.c:867
    #2 0x55669648fee9 in parse_dispatch_command /workspace/repo/sftp.c:1670
    #3 0x5566964928c0 in interactive_loop /workspace/repo/sftp.c:2360
    #4 0x556696493cb6 in main /workspace/repo/sftp.c:2702
    #5 0x7a4bcf753d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)
    #6 0x7a4bcf753e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f)
    #7 0x5566964868a4 in _start (/workspace/repo/sftp+0x1a8a4)

allocated by thread T0 here:
    #0 0x7a4bcfa4e887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x5566964afa60 in sshbuf_get_cstring /workspace/repo/sshbuf-getput-basic.c:290
    #2 0x55669649a228 in sftp_realpath_expand /workspace/repo/sftp-client.c:1051
    #3 0x55669649ed54 in sftp_realpath /workspace/repo/sftp-client.c:1068
    #4 0x55669649232a in interactive_loop /workspace/repo/sftp.c:2269
    #5 0x556696493cb6 in main /workspace/repo/sftp.c:2702
    #6 0x7a4bcf753d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /workspace/repo/sftp.c:377 in path_strip

Reproduction

Attacker runs a malicious SFTP server (or MITMs one) that replies to SSH_FXP_REALPATH with an empty filename string
Client stores empty string as pwd via sftp_realpath()
Victim runs ls; do_ls_dir() calls path_strip(path, pwd)
path_strip computes len=0, strncmp(...,0)==0, then dereferences strip[-1] → OOB read

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-T6EKK5DB.

Reference: ANT-2026-T6EKK5DB
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Calif.

Verdict: true positive
Severity: low

TIMELINE

Dates from discovery through public reveal.

2026-03-26 Reported to tracker
2026-05-08 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-05-30 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

117dd86e0aadff7247dd9e5178c3e5fcd6abcb44e6562e6af3c736bb36f2da9a32f2787bec21723b61ffa939192abe9a65fb3c0ccf697873be888489e90725f4

Committed 2026-05-08 00:10 PT

Revealed 2026-08-17 13:02 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-T6EKK5DB",
  "bug_class": "heap-buffer-overflow (READ of size 1, 1 byte before allocation)",
  "claude_severity": "critical",
  "commit_sha": "fe7dffba1e470987",
  "created_at": "2026-03-27T02:10:30+00:00",
  "description": "In the OpenSSH sftp client, the server's REALPATH response is stored as `pwd` and later passed to path_strip() during `ls`. A malicious SFTP server can return an empty string for REALPATH, making `pwd` a zero-length heap string. In path_strip(), `len = strlen(strip)` is 0 and `strncmp(path, strip, 0)` always succeeds, so the code evaluates `strip[len - 1]`, i.e. `strip[-1]`, reading one byte before the 1-byte allocation. The attacker controls the server responses and needs only the victim to connect and run `ls`. The result is a deterministic 1-byte out-of-bounds heap read.",
  "discovered_at": null,
  "location": "sftp.c:377",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "openssh",
  "reproduction": [
    "1. Attacker runs a malicious SFTP server (or MITMs one) that replies to SSH_FXP_REALPATH with an empty filename string",
    "2. Client stores empty string as `pwd` via sftp_realpath()",
    "3. Victim runs `ls`; do_ls_dir() calls path_strip(path, pwd)",
    "4. path_strip computes len=0, strncmp(...,0)==0, then dereferences strip[-1] → OOB read"
  ],
  "technical_details": "ASAN: \"READ of size 1 at 0x5020000000af ... 1 bytes to the left of 1-byte region\". path_strip() computes `len = strlen(strip)` and, because `strncmp(path, strip, 0) == 0` unconditionally, proceeds to check `strip[len - 1] != '/'` without guarding against `len == 0`, producing a heap-buffer-underflow read at index -1 when the server-supplied `pwd` is empty.",
  "title": "heap-buffer-overflow (READ of size 1, 1 byte before allocation) in openssh",
  "vendor_severity": "low"
}