PT-2026-64379 · Libssh2 · Libssh2

Vladimirelitokarev · CVE-2026-66032 · Publicado 2026-07-24 · Atualizado 2026-07-24

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH FXP OPEN with SSH FXP STATUS containing FX OK, the response data buffer is freed, and if a subsequent sftp packet require() call returns a specific error such as LIBSSH2 ERROR CHANNEL PACKET EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

Correção

Double Free

Enumeração de Fraquezas

CWE-415

Identificadores relacionados

CVE-2026-66032

Produtos afetados

Libssh2

Referências · 4

• https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0 · Correção
• https://github.com/libssh2/libssh2/pull/2180 · Nota
• https://vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-66032 · Nota de Segurança