diff --git a/backport-0020-CVE-2025-5318-fix-possible-buffer-overrun.patch b/backport-0020-CVE-2025-5318-fix-possible-buffer-overrun.patch
new file mode 100644
index 0000000000000000000000000000000000000000..745e7979c8e5bcac26c42242981563f2abc489c8
--- /dev/null
+++ b/backport-0020-CVE-2025-5318-fix-possible-buffer-overrun.patch
@@ -0,0 +1,30 @@
+From ae8881dfe54214c0c0eb88345c35e15a14081b3d Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 22 Apr 2025 21:18:44 +0200
+Subject: CVE-2025-5318: sftpserver: Fix possible buffer overrun
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
+
+Conflict: NA
+Reference:https://git.libssh.org/projects/libssh.git/patch/?id=ae8881dfe54214c0c0eb88345c35e15a14081b3d
+---
+ src/sftpserver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/sftpserver.c b/src/sftpserver.c
+index 9117f15..b3349e1 100644
+--- a/src/sftpserver.c
++++ b/src/sftpserver.c
+@@ -538,7 +538,7 @@ void *sftp_handle(sftp_session sftp, ssh_string handle){
+ 
+   memcpy(&val, ssh_string_data(handle), sizeof(uint32_t));
+ 
+-  if (val > SFTP_HANDLES) {
++  if (val >= SFTP_HANDLES) {
+     return NULL;
+   }
+ 
+-- 
+2.33.0
+
diff --git a/libssh.spec b/libssh.spec
index c367c350e85b0e264eb34dbae247fc94c98afe4a..b5193b4b764e709d579f4db2146a4ac2e9b9b89e 100644
--- a/libssh.spec
+++ b/libssh.spec
@@ -1,6 +1,6 @@
 Name:           libssh
 Version:        0.9.6
-Release:        9
+Release:        10
 Summary:        A library implementing the SSH protocol
 License:        LGPLv2+
 URL:            http://www.libssh.org
@@ -59,6 +59,7 @@ Patch46:        backport-0003-CVE-2023-6918-Systematically-check-return-values-w
 Patch47:        backport-0004-CVE-2023-6918-kdf-Detect-context-init-failures.patch
 Patch48:        backport-0010-CVE-2023-6004-torture_config-Allow-multiple-in-usern.patch
 Patch49:        backport-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch
+Patch50:        backport-0020-CVE-2025-5318-fix-possible-buffer-overrun.patch
 
 BuildRequires:  cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel
 BuildRequires:  krb5-devel libcmocka-devel openssh-clients openssh-server
@@ -144,6 +145,12 @@ popd
 %doc ChangeLog README
 
 %changelog
+* Wed Jul 2 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.9.6-10
+- Type:CVE
+- Id:CVE-2025-5318
+- SUG:NA
+- DESC:fix CVE-2025-5318
+
 * Wed Feb 7 2024 renmingshuai <renmingshuai@huawei.com> - 0.9.6-9
 - Type:bugfix
 - Id: