PT-2026-64379 · Libssh2 · Libssh2

Vladimirelitokarev · CVE-2026-66032 · Published 2026-07-24 · Updated 2026-07-24

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH FXP OPEN with SSH FXP STATUS containing FX OK, the response data buffer is freed, and if a subsequent sftp packet require() call returns a specific error such as LIBSSH2 ERROR CHANNEL PACKET EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CVE-2026-66032

Affected Products

Libssh2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-66032 · Security Note
• https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0 · Patch
• https://vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open · Note
• https://github.com/libssh2/libssh2/pull/2180 · Note