CVE-2026-66032 Details
Description
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
A double-free vulnerability has been identified in libssh2 versions prior to 1.11.1, within the sftp_open() function of src/sftp.c. This vulnerability allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. The issue arises when a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS indicating FX_OK. In this scenario, the response data buffer is freed, but if a subsequent sftp_packet_require() call returns a specific error, such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed again. This double-free creates conditions that can be exploited on glibc systems, leading to overlapping allocations and function pointer overwrites.
Users can upgrade to libssh2 version 1.11.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0 | [email protected] | Patch |
| https://github.com/libssh2/libssh2/pull/2180 | [email protected] | Issue TrackingPatch |
| https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libssh2 libssh2 | <= 1.11.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Jul 25, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |