What is CVE-2025-47914?

CVE-2025-47914 is a medium-severity vulnerability in Golang Crypto, classified under Out-of-bounds Read. CVSS score: 5.3/10. Published 2025-11-19.

How severe is CVE-2025-47914?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Out-of-bounds Read in Golang Crypto

CVE-2025-47914

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Vulnerability class: Buffer Overflow

EPSS: 0.005 (40.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Golang Crypto
Golang.org/x/crypto Golang.org/x/crypto/ssh/agent — versions 0

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

security@golang.org (Mailing List)
security@golang.org (Patch)
security@golang.org (Patch, Issue Tracking)
security@golang.org (Vendor Advisory)

Frequently asked questions

What is CVE-2025-47914?: CVE-2025-47914 is a medium-severity vulnerability in Golang Crypto, classified under Out-of-bounds Read. CVSS score: 5.3/10. Published 2025-11-19.
How severe is CVE-2025-47914?: Medium severity. CVSS v3 base score is 5.3 out of 10.