libssh2 Publickey List Uninitialized Memory Use

Executive Summary

CVE-2026-58051 is a vulnerability in the libssh2 library's publickey subsystem where the publickey list grows without zero-initializing new entries before parsing them. If parsing fails, the cleanup function may operate on uninitialized or attacker-controlled pointers, leading to memory corruption.

Specifically, a malicious SSH server can send malformed responses that trigger this flaw, causing the client to free uninitialized or attacker-influenced memory pointers during cleanup.

Exploits include two main paths: on Win32, an integer overflow causes a buffer overflow allowing arbitrary code execution; on Win64, a malformed response triggers premature freeing of attacker-shaped buffers, enabling execution of arbitrary code through heap manipulation.

The vulnerability affects multiple functions related to list growth, attribute allocation, parsing, and cleanup in the publickey subsystem.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to undefined behavior such as application crashes, memory corruption, or even arbitrary code execution on the client using libssh2 when connecting to a malicious SSH server.

An attacker controlling an SSH server can exploit malformed publickey subsystem responses to manipulate memory pointers during cleanup, potentially executing malicious code or causing denial of service.

The CVSS v4 score of 8.3 indicates a high impact, particularly affecting availability and potentially allowing remote code execution without user interaction or privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malformed responses from a malicious SSH server targeting the libssh2 client's publickey subsystem. Detection would involve monitoring SSH client interactions for unusual or malformed publickey subsystem responses that could trigger the vulnerability.

Proof-of-concept exploits and test cases are available that demonstrate the vulnerability through crafted SSH transport scenarios. Using these PoCs in a controlled environment can help detect if your libssh2 client is vulnerable.

Specific commands are not provided in the available resources, but you can test your system by running the proof-of-concept code from Resource 1, which includes exploit code targeting the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating libssh2 to a version later than 1.11.1 where the vulnerability is fixed by zero-initializing new list entries and rejecting oversized attribute counts.

If updating is not immediately possible, avoid connecting to untrusted or potentially malicious SSH servers that might exploit the malformed publickey subsystem responses.

Additionally, monitoring and filtering SSH traffic to detect and block malformed publickey subsystem responses can reduce exposure.

Useful 0 Not Useful 0