Is CVE-2026-66035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66035 being exploited in the wild.

How severe is CVE-2026-66035?

High severity, with a CVSS score of 7.5, published 24 July 2026.

Is there a fix for CVE-2026-66035?

A patch was published on 2026-07-03: Fix merged in pull request 2198 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66035 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66035?

Check whether you run Libssh2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66035: libssh2 heap buffer overflow in transport layer during EtM negotiation

CVE-2026-66035 · Severity: high · CVSS 7.5 · Published 2026-07-24

libssh2 is a widely used library that allows applications to communicate securely using the SSH protocol. A vulnerability has been identified where a malicious SSH server can compromise a client application that connects to it. This could allow an attacker to take control of the connecting system or crash the application before the user even logs in.

Technologies: Libssh2. Vendors: Libssh2.

Quick answers

Is CVE-2026-66035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66035 being exploited in the wild.
How severe is CVE-2026-66035?: High severity, with a CVSS score of 7.5, published 24 July 2026.
Which products and versions are affected?: Libssh2 through 1.11.1.
Is there a fix for CVE-2026-66035?: A patch was published on 2026-07-03: Fix merged in pull request 2198 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66035 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66035?: Check whether you run Libssh2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the fullpacket() function within src/transport.c of libssh2. During Encrypt-then-MAC (EtM) cipher negotiation, the code allocates a buffer based on a provided packet_length but proceeds to copy 'blocksize minus one' bytes. If the packet_length is smaller than the cipher's block size, a memcpy operation overflows the allocated buffer. On 32-bit systems using glibc, this can overwrite the SIZE field of adjacent heap chunks, leading to tcache bin confusion, overlapping objects, and potential arbitrary code execution via function pointer overwrites. The vulnerability is triggered pre-authentication when a client connects to a malicious server. A fix is available in commit 42e33d8.

Affected products

libssh2 libssh2 through 1.11.1

Timeline

2026-07-03: patched: Fix merged in pull request 2198
2026-07-24: disclosed: CVE-2026-66035 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.