CVE-2026-66032: libssh2 Use-After-Free Vulnerability

CVE-2026-66032 Overview

CVE-2026-66032 is a double-free vulnerability [CWE-415] in libssh2 through version 1.11.1, located in the sftp_open() function within src/sftp.c. A malicious SSH server can corrupt the heap of any authenticated client that opens an SFTP session. The flaw enables tcache dup conditions on glibc systems, allowing overlapping allocations and function pointer overwrites. The issue is fixed in commit 5e47761.

Critical Impact
A malicious SSH server can trigger heap corruption in authenticated libssh2 clients opening SFTP sessions, potentially leading to arbitrary code execution through tcache dup exploitation on glibc-based systems.

Affected Products

libssh2 versions through 1.11.1
Applications and utilities linking against vulnerable libssh2 builds
Linux distributions shipping libssh2 with glibc heap allocator

Discovery Timeline

2026-07-24 - CVE-2026-66032 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66032

Vulnerability Analysis

The vulnerability resides in the sftp_open() function in src/sftp.c. When an SSH server responds to an SSH_FXP_OPEN request with SSH_FXP_STATUS containing FX_OK, libssh2 frees the response data buffer using SSH2_FREE(session, data). The pointer to that buffer is not nullified after being freed.

A subsequent call to sftp_packet_require() may return an error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED. Under this error path, the same dangling pointer is freed a second time. The double free corrupts glibc's tcache, enabling attacker-controlled overlapping allocations and function pointer overwrites.

Root Cause

The root cause is a missing pointer nullification after the initial SSH2_FREE() call. The data variable retains its stale address, and error-handling logic later in sftp_open() releases it again. This violates safe memory management practices for heap-allocated packet buffers.

Attack Vector

Exploitation requires a victim client to authenticate to a malicious or compromised SSH server and initiate an SFTP session. The attacker crafts responses that first return FX_OK and then force sftp_packet_require() into the specific error branch. Successful exploitation yields heap primitives suitable for code execution on glibc systems.

                 ssh2_deb((session, LIBSSH2_TRACE_SFTP, "got HANDLE FXOK"));
 
                 SSH2_FREE(session, data);
+                data = NULL;
 
                 /* silly situation, but check for a HANDLE */
                 rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,

Source: GitHub Commit 5e47761 - The patch nullifies data after freeing it, preventing the second free from operating on a dangling pointer.

Detection Methods for CVE-2026-66032

Indicators of Compromise

Unexpected client-side crashes or SIGSEGV events in processes linking libssh2 immediately after SFTP session initiation
SSH client connections to unfamiliar or newly registered SFTP servers followed by abnormal process termination
Heap corruption signatures in core dumps of libssh2-dependent applications such as curl, git, or custom automation tooling

Detection Strategies

Inventory all binaries linking libssh2 and compare against version 1.11.1 or earlier using package managers and software bill of materials (SBOM) data
Monitor outbound SSH and SFTP connections from workstations and servers, flagging connections to untrusted destinations
Enable glibc heap protection diagnostics such as MALLOC_CHECK_=3 in test environments to surface double-free conditions

Monitoring Recommendations

Correlate crash telemetry with recent SFTP session activity to identify potential exploitation attempts
Alert on new outbound SSH sessions to internet-facing hosts that are not on approved allowlists
Track process behavior of libssh2-linked applications for anomalous child process creation following SFTP operations

How to Mitigate CVE-2026-66032

Immediate Actions Required

Upgrade libssh2 to a build that includes commit 5e4776146552d898b9c0e1b313cd093fa8dc92d0 or a released version above 1.11.1
Rebuild and redeploy applications that statically link libssh2 after upgrading the library source
Restrict SFTP client connections to trusted server allowlists until patches are deployed across the environment

Patch Information

The fix was merged in GitHub Pull Request #2180 and committed as 5e4776146552d898b9c0e1b313cd093fa8dc92d0. Refer to the VulnCheck Security Advisory for additional technical detail and remediation guidance.

Workarounds

Avoid initiating SFTP sessions against untrusted or unverified SSH servers until the library is patched
Enforce strict host key verification and pin known-good server fingerprints in SSH client configurations
Isolate automation systems that perform SFTP operations in network segments with egress filtering to known destinations

bash

# Verify installed libssh2 version and rebuild after upgrade
ldconfig -p | grep libssh2
pkg-config --modversion libssh2

# Example: rebuild libssh2 from patched source
git clone https://github.com/libssh2/libssh2.git
cd libssh2
git checkout 5e4776146552d898b9c0e1b313cd093fa8dc92d0
mkdir build && cd build
cmake .. && make && sudo make install