CVE-2026-66034 Details

A heap out-of-bounds read vulnerability has been identified in libssh2 versions prior to 1.11.1. This vulnerability allows a malicious SSH server to exploit the publickey subsystem, triggering an arbitrary-length out-of-bounds read and freeing an uninitialized pointer. The issue arises in the function libssh2_publickey_list_fetch(), where the version 1 response parser processes a server-controlled comment length value without adequate bounds checking. This oversight leads to the out-of-bounds read, which can leak heap pointers from adjacent memory allocations, bypassing Address Space Layout Randomization (ASLR). The vulnerability is further compounded by heap allocator state corruption, as the error cleanup process inadvertently frees an uninitialized pointer from a non-zeroed realloc() region.

Users can upgrade to libssh2 version 1.11.1 or later to address this vulnerability.