libssh2, used in many SSH client applications, contains a pre‑authentication integer underflow in the ssh2_cipher_crypt() routine. During the handshake, if an attacker forces the server to negotiate an AES‑GCM cipher, the library computes a block size value that underflows, producing an out‑of‑bounds read and a memcpy with a value close to SIZE_MAX. This results in an immediate crash of the client process before authentication succeeds. The flaw is a classic integer underflow (CWE‑125) and a signed integer wrap‑around (CWE‑191), but it does not provide access to arbitrary code execution; its effect is a denial‑of‑service condition on the client side.

All installations of libssh2 1.11.1 and earlier that rely on the default cipher negotiation logic are vulnerable. The vulnerability is present in the libssh2 libssh2 library used by applications that perform SSH connections, regardless of the operating system.

The CVSS score of 8.7 indicates a high severity impact. The EPSS score is below 1 %, meaning the likelihood of exploitation has been assessed as very low, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need to control an SSH server that forces AES‑GCM negotiation; no authentication is required. Once the vulnerable client connects, it will crash immediately, making this vulnerability useful for DoS attacks against services that depend on libssh2.