The vulnerability exists due to improper buffer index progression checks inside the SSH protocol version string analyzer. Sending an unauthenticated stream containing millions of trailing null bytes before the version declaration overflows local input tracking variables.