CVE-2026-66032: libssh2 Double-Free Heap Corruption via sftp_open()
Last updated 4 September 2026
Other sources
libssh2 Double-Free Heap Corruption via sftpopen()
— Microsoft
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containing FXOK, the response data buffer is freed, and if a subsequent sftppacketrequire() call returns a specific error such as LIBSSH2ERRORCHANNELPACKETEXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.1-5 - Upgrade
Upgrade
debian/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-6 - Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Fixed in 1.11.1Patch commit 5e47761 - Compensating control
Mitigate the risk from a malicious SSH server by restricting which SSH/SFTP servers clients can connect to (e.g., allowlisting trusted hosts at the network/firewall/ACL level) until libssh2 is updated to include commit 5e47761.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66032?
CVE-2026-66032 has a severity rating of 8.8, which is classified as high.
How do I fix CVE-2026-66032?
To fix CVE-2026-66032, update libssh2 to version 1.11.2 or later, where the vulnerability has been addressed.
What kind of vulnerability is CVE-2026-66032?
CVE-2026-66032 is a double-free vulnerability that affects the sftp_open() function in libssh2.
Who is affected by CVE-2026-66032?
CVE-2026-66032 affects authenticated clients using libssh2 versions prior to 1.11.2 when opening an SFTP session.
What could happen if CVE-2026-66032 is exploited?
Exploitation of CVE-2026-66032 could lead to heap corruption and potentially allow an attacker to execute arbitrary code on the client.