VulnSocial

CVE-2026-66032Patch(libssh2 / libssh2)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch libssh2 libssh2 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

libssh2 CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-415

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • libssh2

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Peaked 3d ago at 1 mentions (2026-07-24); latest day: 1
  • 4 total mentions across 4 days

Affected systems

Vendors
libssh2
Products
libssh2

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-07-24: 1Mentions · 2026-07-28: 1Mentions · 2026-08-05: 1Mentions · 2026-10-15: 1Patch / Workaround · 2026-07-24: 1Patch / Workaround · 2026-07-28: 1Patch / Workaround · 2026-08-05: 1Technical Details · 2026-07-24: 1Technical Details · 2026-07-28: 1Technical Details · 2026-08-05: 107-2407-2808-0510-15
Signal classification1 categories
Patch
3100.0%
Referenced assets1 URL
Full discourse4 posts
  • iototsecnews@iototsecnews
    Patch

    libssh2 の脆弱性 CVE-2026-66032／66033／66034／66035 が FIX：悪意の SSH サーバによるクライアント破壊 https://iototsecnews.jp/2026/07/28/libssh2-vulnerabilities-allow-a-malicious-ssh-server-to-corrupt-client-memory/ libssh2 の脆弱性 CVE-2026-66032／CVE-2026-66033／CVE-2026-66034／CVE-2026-66035 は、接続時のデータ検証やメモリ管理の不備に起因するものです。悪意の送信元との通信により内部の処理が乱され、プログラムの停止や意図しない動作などが引き起こされる恐れがあります。システムを安全に利用するためにも、対策が施された修正版ライブラリへの更新を速やかに実施してください。組み込み型のプログラムを利用している場合には、個別でのアップデート対応が必要になる点にも注意が必要です。 #CVE202666032 #CVE202666033 #CVE202666034 #CVE202666035 #libssh2 #Vulnerability

    Post summary

    The article reports that libssh2 CVE‑2026‑66032‑66035 allow a malicious SSH server to corrupt client memory, and it urges users to install the patched library promptly.

    02000159
    506 followersView on X
  • GCP Weekly@gcpweekly

    This addresses the following vulnerabilities: CVE-2026-35189 CVE-2026-35191 CVE-2026-42772 CVE-2026-5450 CVE-2026-54872 CVE-2026-54873 CVE-2026-54875 CVE-2026-58050 CVE-2026-58051 CVE-2026-5928 CVE-2026-66032 CVE-2026-66033 CVE-2026-66034 CVE-2026-66035 CVE-2026-72897 5/16

    1000029
    1.8K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 libssh2'de keşfedilen dört kritik güvenlik açığı (CVE-2026-66032, CVE-2026-66033, CVE-2026-66034 ve CVE-2026-66035), kötü niyetli bir SSH/SFTP sunucusunun istemci uygulamalarında bellek bozulmasına, uygulamanın çökmesine ve bazı senaryolarda potansiyel uzaktan kod çalıştırmaya neden olabilmesine yol açıyor. Etkilenen sürümler: libssh2 1.11.1 ve öncesi. Kullanıcıların ve sistem yöneticilerinin, libssh2'yi veya bu kütüphaneyi kullanan uygulamaları güncel sürüme yükseltmeleri önerilir.

    Post summary

    Four critical CVEs (CVE‑2026‑66032‑66035) in libssh2 cause memory corruption, crashes, and potential RCE; users are urged to update to a newer version to mitigate the issue.

    0000084
    1.3K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - libssh2 Double-Free Heap Corruption via sftp_open() (CVE-2026-66032) libssh2 (through 1.11.1) contains a double-free in sftp_open(). When a malicious SSH server answers SSH_FXP_OPEN with SSH_FXP_STATUS FX_OK, the response buffer is freed; if a following sftp_packet_require() returns an error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed again. On glibc this enables tcache-dup conditions - overlapping allocations and function-pointer overwrites - so a malicious or compromised SFTP server can corrupt the heap of any authenticated client that opens an SFTP session, a credible path to code execution. libssh2 is embedded in curl, Git, PHP, and many network tools. CVSS 8.7. 👉Update libssh2 to the release containing fix commit 5e47761, and rebuild/patch downstream software that bundles it.

    Post summary

    The advisory outlines a double-free heap corruption in libssh2 (CVE‑2026‑66032) with a CVSS of 8.7, explains the impact on SFTP clients, and recommends updating to the patched commit 5e47761.

    0000059
    254 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applibssh2libssh2---

Explore more

Back to dashboardlibssh2 CVEslibssh2 vulnerabilities