Executive brief
libssh2 is a widely used library that allows applications to securely transfer files and execute commands over the SSH protocol. A security flaw has been identified where a malicious SSH server can crash or take control of a client application when the client attempts to open a file via SFTP. This could lead to unauthorized access to the client's system or data if a user connects to an untrusted server.
Technical details
A double-free vulnerability exists in src/sftp.c within the sftp_open() function of libssh2. When a server responds to an SSH_FXP_OPEN request with an SSH_FXP_STATUS of FX_OK, the response data buffer is freed. If a subsequent call to sftp_packet_require() fails with a specific error (e.g., LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED), the same pointer is freed again. On systems using glibc, this can trigger tcache dup conditions, leading to overlapping heap allocations and potential function pointer overwrites. An attacker must control the SSH server the client connects to. The issue is fixed in commit 5e47761 by nullifying the pointer after the initial free.
Affected products
- libssh2 libssh2 <= 1.11.1
Timeline
- 2026-07-02: patched: Fix merged into master branch via commit 5e47761
- 2026-07-24: disclosed: CVE-2026-66032 published