Heap Buffer Overflow in libssh2 Affects SSH Clients and Servers

CVE-2026-66035

What is CVE-2026-66035?

A heap buffer overflow vulnerability exists in libssh2, allowing an attacker-controlled SSH server to exploit pre-authentication sessions. The flaw, which affects versions up to 1.11.1, can be triggered during Encrypt-then-MAC cipher negotiation. By sending packets with a length smaller than the required block size, the malicious server can manipulate memory allocations in connecting clients. This can lead to corruption of heap metadata, facilitating various attack vectors including tcache bin confusion and function pointer overwrites during session handshakes. Immediate action is recommended to mitigate risks associated with this vulnerability.

References