CVE-2026-66032
Received Received - Intake

Double-Free in libssh2 SFTP Client

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66032
EUVD
EUVD-2026-48719

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libssh2 libssh2 to 1.11.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libssh2 through 1.11.1 has a double-free vulnerability in the sftp_open() function. A malicious SSH server can exploit this by sending a specific response to an SFTP session request, causing the client to free the same memory twice. This can lead to heap corruption and potential arbitrary code execution on affected systems.

Detection Guidance

Detection of CVE-2026-66032 requires checking for vulnerable versions of libssh2. Use commands like 'dpkg -l | grep libssh2' on Debian-based systems or 'rpm -qa | grep libssh2' on RPM-based systems to identify installed versions. If the version is 1.11.1 or earlier, the system is vulnerable.

Impact Analysis

If you use a vulnerable version of libssh2, an attacker could exploit this flaw to execute arbitrary code on your system, potentially gaining control over it. This could lead to data theft, system compromise, or further network infiltration if the affected application has elevated privileges.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access or data breaches through heap corruption in authenticated SFTP sessions. Exploitation may lead to data leaks or integrity issues, violating confidentiality and security requirements under these regulations.

Mitigation Strategies

Update libssh2 to version 1.11.1 or later, which fixes the double-free vulnerability in the sftp_open() function. Avoid using vulnerable versions for SFTP sessions with untrusted SSH servers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart