CVE-2026-66032: libssh2 Double-Free Heap Corruption via sftp_open()
libssh2 Double-Free Heap Corruption via sftpopen()
Other sources
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containing FXOK, the response data buffer is freed, and if a subsequent sftppacketrequire() call returns a specific error such as LIBSSH2ERRORCHANNELPACKETEXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.1-5 - Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Fixed in 1.11.1Patch 5e47761 - Compensating control
Mitigate by preventing untrusted/malicious SSH servers from accepting authenticated clients for SFTP (e.g., restrict which SSH/SFTP servers clients may connect to via allowlisting/firewall rules).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66032?
CVE-2026-66032 has a severity rating of 8.8, which is classified as high.
How do I fix CVE-2026-66032?
To fix CVE-2026-66032, update libssh2 to version 1.11.2 or later, where the vulnerability has been addressed.
What kind of vulnerability is CVE-2026-66032?
CVE-2026-66032 is a double-free vulnerability that affects the sftp_open() function in libssh2.
Who is affected by CVE-2026-66032?
CVE-2026-66032 affects authenticated clients using libssh2 versions prior to 1.11.2 when opening an SFTP session.
What could happen if CVE-2026-66032 is exploited?
Exploitation of CVE-2026-66032 could lead to heap corruption and potentially allow an attacker to execute arbitrary code on the client.