A newly disclosed four high-severity vulnerabilities in libssh2, the widely used SSH library embedded in countless client applications, tools, and DevOps pipelines.
A malicious or compromised SSH server can corrupt client-side memory, ranging from crashes to potential remote code execution, simply by responding maliciously during connection or authentication. Affected versions are libssh2 <= 1.11.1, with fixes merged upstream.
Critical Four libssh2 Flaws
Rated 8.7 on CVSS v4, this double-free vulnerability (CWE-415), tracked as CVE-2026-66032, resides in sftp_open() in src/sftp.c. When a server sends SSH_FXP_STATUS with FX_OK in response to SSH_FXP_OPEN, the response buffer is freed.
If a subsequent sftp_packet_require() call returns LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed again. On glibc systems, this enables tcache dup conditions, allowing attackers to create overlapping allocations and potentially overwrite function pointers.
This pre-authentication flaw, identified as CVE-2026-66033 with a CVSS score of 8.7, hits ssh2_cipher_crypt() in src/openssl.c.
By negotiating AES-GCM ciphers during handshake, a malicious server triggers an integer underflow (CWE-191) in the calculation of block size minus AAD length minus tag length.
The resulting out-of-bounds read feeds a memcpy() call with a length argument near SIZE_MAX, crashing the client instantly, before authentication even occurs.
With a CVSS score of 7.7, CVE-2026-66034 involves libssh2_publickey_list_fetch(). The version 1 response parser trusts a server-supplied comment_len value without verifying remaining buffer bytes.
This causes an arbitrary-length heap out-of-bounds read (CWE-125) that leaks adjacent heap pointers, defeating ASLR. Worse, the error cleanup path then frees an uninitialized pointer from a non-zeroed realloc() region, corrupting allocator state.
Also scoring 7.7, CVE-2026-66035 targets the Encrypt-then-MAC path in fullpacket() (src/transport.c). By sending a packet with a packet_length smaller than the cipher’s block size, an attacker causes libssh2 to allocate a buffer of packet_length bytes while copying blocksize - 1 bytes into it.
On 32-bit glibc, this overflow can corrupt adjacent chunk metadata, enabling tcache bin confusion and function pointer overwrites during handshake.
All four bugs, CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, and CVE-2026-66035, require nothing from the victim beyond connecting to (or already trusting) a malicious server.
Making them attractive for supply-chain-style attacks against CI/CD pipelines, automated deployment tools, and any software embedding libssh2 for outbound SSH/SFTP connections.
Three of the four are pre- or peri-authentication, meaning credentials aren’t a prerequisite for exploitation.
Mitigation
Organizations should immediately audit dependencies for libssh2 usage and upgrade past the patched commits: 5e47761 (CVE-2026-66032), a2ed82d (CVE-2026-66033), a13bb6c (CVE-2026-66034), and 42e33d8 (CVE-2026-66035).
Given the heap corruption primitives involved, particularly the tcache manipulation in CVE-2026-66032 and CVE-2026-66035, treat these as high-priority patches rather than routine maintenance updates.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
