CVE-2026-66032: libssh2 Double-Free Heap Corruption via sftp_open()
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containing FXOK, the response data buffer is freed, and if a subsequent sftppacketrequire() call returns a specific error such as LIBSSH2ERRORCHANNELPACKETEXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Patch 5e47761
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66032?
CVE-2026-66032 has a severity rating of 8.8, which is classified as high.
How do I fix CVE-2026-66032?
To fix CVE-2026-66032, update libssh2 to version 1.11.2 or later, where the vulnerability has been addressed.
What kind of vulnerability is CVE-2026-66032?
CVE-2026-66032 is a double-free vulnerability that affects the sftp_open() function in libssh2.
Who is affected by CVE-2026-66032?
CVE-2026-66032 affects authenticated clients using libssh2 versions prior to 1.11.2 when opening an SFTP session.
What could happen if CVE-2026-66032 is exploited?
Exploitation of CVE-2026-66032 could lead to heap corruption and potentially allow an attacker to execute arbitrary code on the client.