CVE-2026-66034
Received Received - Intake

Heap Out-of-Bounds Read in libssh2 Publickey Subsystem

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-66034
EUVD
EUVD-2026-48721

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libssh2 libssh2 to 1.11.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libssh2 through 1.11.1 allows a malicious SSH server to exploit a missing bounds check in the publickey subsystem. It enables an arbitrary-length heap out-of-bounds read and freeing of an uninitialized pointer. The issue occurs in libssh2_publickey_list_fetch() where a server-controlled comment_len value is read without verifying sufficient buffer bytes remain, causing heap pointer leaks that defeat ASLR and heap allocator state corruption.

Detection Guidance

This vulnerability requires inspecting libssh2 versions and network traffic for malicious SSH server responses. Check libssh2 version with 'libssh2_version()' or package manager commands like 'dpkg -l libssh2' or 'rpm -qa libssh2'. Monitor SSH server responses for malformed publickey subsystem messages, particularly version 1 responses with unusually long comment fields.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory contents, bypass ASLR protections, and corrupt heap memory, potentially leading to remote code execution or denial of service. If exploited, it may compromise the confidentiality and integrity of data transmitted over SSH connections.

Compliance Impact

This vulnerability allows a malicious SSH server to read arbitrary heap memory and corrupt allocator state, which could potentially expose sensitive data like authentication credentials or personal information. This could impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized access to protected information.

Mitigation Strategies

Update libssh2 to version 1.11.1 or later where the bounds check is fixed. If updating is not possible, restrict SSH server access to trusted clients, disable the publickey subsystem if unused, and monitor for suspicious SSH traffic patterns indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66034. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart