# CVE-2026-66032: libssh2 double free in sftp_open

Source: https://junglewise.ai/threats/cve-2026-66032-libssh2-double-free-in-sftp-open  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-66032 · Severity: high · CVSS 8.8 · Published 2026-07-24

libssh2 is a widely used library that allows applications to securely transfer files and execute commands over the SSH protocol. A security flaw has been identified where a malicious SSH server can crash or take control of a client application when the client attempts to open a file via SFTP. This could lead to unauthorized access to the client's system or data if a user connects to an untrusted server.

Technologies: [Libssh2](https://junglewise.ai/threats/technologies/libssh2). Vendors: [Libssh2](https://junglewise.ai/threats/vendors/libssh2).

## Quick answers

**Is CVE-2026-66032 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66032 being exploited in the wild.

**How severe is CVE-2026-66032?** High severity, with a CVSS score of 8.8, published 24 July 2026.

**Which products and versions are affected?** Libssh2 <= 1.11.1.

**Is there a fix for CVE-2026-66032?** A patch was published on 2026-07-02: Fix merged into master branch via commit 5e47761 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66032 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-66032?** Check whether you run Libssh2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A double-free vulnerability exists in src/sftp.c within the sftp_open() function of libssh2. When a server responds to an SSH_FXP_OPEN request with an SSH_FXP_STATUS of FX_OK, the response data buffer is freed. If a subsequent call to sftp_packet_require() fails with a specific error (e.g., LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED), the same pointer is freed again. On systems using glibc, this can trigger tcache dup conditions, leading to overlapping heap allocations and potential function pointer overwrites. An attacker must control the SSH server the client connects to. The issue is fixed in commit 5e47761 by nullifying the pointer after the initial free.

## Affected products

- libssh2 libssh2 <= 1.11.1

## Timeline

- 2026-07-02: patched: Fix merged into master branch via commit 5e47761
- 2026-07-24: disclosed: CVE-2026-66032 published

## References

- [https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0](https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0)
- [https://github.com/libssh2/libssh2/pull/2180](https://github.com/libssh2/libssh2/pull/2180)
- [https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open](https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open)

## Related threats

- [libssh2 heap buffer overflow in transport layer during EtM negotiation](https://junglewise.ai/threats/cve-2026-66035-libssh2-heap-buffer-overflow-in-transport-layer-during-etm)
- [libssh2 heap out-of-bounds read in publickey_list_fetch](https://junglewise.ai/threats/cve-2026-66034-libssh2-heap-out-of-bounds-read-in-publickey-list-fetch)
- [libssh2 integer underflow in ssh2_cipher_crypt](https://junglewise.ai/threats/cve-2026-66033-libssh2-integer-underflow-in-ssh2-cipher-crypt)
- [libssh2 uninitialized pointer free in publickey list cleanup](https://junglewise.ai/threats/cve-2026-58051-libssh2-uninitialized-pointer-free-in-publickey-list-cleanup)
- [libssh2 heap buffer overflow in publickey-subsystem attribute allocation](https://junglewise.ai/threats/cve-2026-58050-libssh2-heap-buffer-overflow-in-publickey-subsystem-attribute)