Integer Overflow vulnerability in the SFTP server implementation of libssh. The flaw exists in the sftp_decode_channel_data_to_packet() function, where a crafted packet with a large payload size (e.g., 0x7ffffffc) bypasses a validity check due to integer overflow on 32-bit platforms. While this does not lead to direct memory corruption, the failure to allocate the excessively large buffer results in a self-induced denial of service (DoS). This issue can only be exploited by authenticated users with SFTP access and affects servers running on 32-bit systems.

Affected versions: libssh 0.11.0 and 0.11.1