A flaw was found in libssh server-side SFTP directory listing. In process_readdir() in src/sftpserver.c, the server allocates a fixed stack buffer as char long_name[MAX_LONG_NAME_LEN] and passes attacker-controlled directory entry names into readdir_long_name(). In the pre-patch implementation, readdir_long_name() appends metadata and the filename into z_long_name with repeated unbounded strcat() calls. Because z_long_name points at the caller-owned fixed stack buffer, sufficiently long filenames in an attacker-controlled directory can overflow that stack buffer during SSH_FXP_READDIR processing, leading to crashes and possible code execution on the server.