libssh2 through 1.11.1 contains a flaw in the publickey list cleanup path where newly reallocated entries are not zero‑initialized before parsing. When a remote SSH server responds with malformed publickey subsystem data that triggers a parse failure, the cleanup routine attempts to free an uninitialized and attacker‑influenced pointer. This can lead to memory corruption or client process crash. The weakness is classified as CWE‑908 (Uninitialized Pointer).

The vulnerability affects the libssh2 library distributed by the libssh2 project. Any software that embeds libssh2 1.11.1 or earlier is potentially impacted until updated to a patched release.

The CVSS score of 8.3 indicates a high severity. EPSS data is not available, and the issue is not listed in CISA's KEV catalog, suggesting limited exploitation activity. The attack vector requires the victim to initiate a connection to a malicious SSH server capable of sending the crafted publickey subsystem response, making the threat most relevant to client software exposed to untrusted SSH servers.