Description
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
Published: 2026-07-24
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A double‑free bug in the sftp_open() routine of libssh2 allows a malicious SSH server to corrupt the heap of any authenticated client that opens an SFTP session. The sequence requires the server to reply with SSH_FXP_STATUS containing FX_OK, followed by a packet that causes a second free of the same buffer. This condition enables glibc tcache duplication attacks that can overwrite function pointers, potentially leading to arbitrary code execution on the client system.

Affected Systems

Libssh2, the SSH client library, is affected in all releases up to and including version 1.11.1. The vulnerability was fixed by commit 5e47761, and any installation running a pre‑1.11.1 build is at risk.

Risk and Exploitability

The CVSS base score of 8.7 marks this as high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers require the ability to run a malicious SSH server and gain authenticated access to a client that uses libssh2 to open an SFTP session. The exploit path is straightforward: connect to the vulnerable server, send the specific sequence of status and packet responses, and trigger the double free, leading to heap corruption and potential code execution.

Generated by OpenCVE AI on August 3, 2026 at 19:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install a libssh2 build that includes the fix from commit 5e47761, which resolves the double‑free bug.
  • If an immediate upgrade is not possible, disable SFTP functionality in client applications until the library can be updated or restrict connections to trusted SSH servers only.
  • Run libssh2‑based clients with reduced privileges or in a sandboxed environment to limit the damage scope of potential code execution.

Generated by OpenCVE AI on August 3, 2026 at 19:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-1341
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Sat, 25 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Libssh2
Libssh2 libssh2
Vendors & Products Libssh2
Libssh2 libssh2

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
Title libssh2 Double-Free Heap Corruption via sftp_open()
Weaknesses CWE-415
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Libssh2 Libssh2
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-28T01:06:24.681Z

Reserved: 2026-07-23T20:45:17.816Z

Link: CVE-2026-66032

cve-icon Vulnrichment

Updated: 2026-07-24T17:07:51.547Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-24T17:17:35.120

Modified: 2026-08-07T01:07:10.710

Link: CVE-2026-66032

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-24T16:32:39Z

Links: CVE-2026-66032 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T20:00:12Z

Weaknesses
  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free