Double-Free Vulnerability in libssh2 Affects SFTP Functionality

CVE-2026-66032

What is CVE-2026-66032?

A double-free vulnerability has been identified in libssh2, specifically in the sftp_open() function located in src/sftp.c. This flaw allows an attacker operating a malicious SSH server to exploit the heap space of any client that has authenticated and opened an SFTP session. The issue arises when an SSH response is processed incorrectly, leading to a situation where memory is freed twice. This can lead to critical overlapping allocations that might enable attackers to overwrite function pointers, potentially allowing for arbitrary code execution on glibc systems.

References