Missing Bounds Check Vulnerability in libssh2 SSH Library

CVE-2026-66034

What is CVE-2026-66034?

A vulnerability exists in libssh2 up to version 1.11.1 that stems from a missing bounds check in the publickey subsystem. A malicious SSH server can exploit this flaw, leading to an arbitrary-length heap out-of-bounds read. This occurs in the libssh2_publickey_list_fetch() function, where the parser incorrectly processes a server-controlled value for comment length without adequate verification of available buffer space. As a result, this vulnerability not only allows leakage of sensitive heap pointers due to Address Space Layout Randomization (ASLR) bypass, but it also may corrupt heap allocator state when the cleanup process inadvertently frees an uninitialized pointer derived from a non-zeroed memory region.

References