CVE-2026-66032

What it is

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-07-24 17:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-07 01:07 UTC Last updatedMost recent change to the record

Details

Published

2026-07-24 17:17 UTC

Last modified

2026-08-07 01:07 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-415

Record status

Analyzed

Affected

• libssh2 ≤ 1.11.1

Attack profile CVSS 4.0 · 8.7

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Passive

Confidentiality

High

Integrity

High

Availability

High