← Vulnerability feed

Vulnerability record · CVE-2026-66032 · published 24 July 2026

CVE-2026-66032: Libssh2 double free vulnerability

LLibssh2 · Libssh2

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

8.7 CVSS 4.0 High EPSS 0.45% · top 63.5% CWE-415 · Double free
8.7CVSS 4.0 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
7 Aug 2026Last modified by NVD

Description

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0 Patch
https://github.com/libssh2/libssh2/pull/2180 Issue TrackingPatch
https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open PatchThird Party Advisory

Track CVE-2026-66032 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-55200Libssh2 vulnerabilitylibssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bo…EPSS 0.83%9.1CVE-2019-3860Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compr…EPSS 5.1%9.1CVE-2019-3861Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length a…EPSS 5.1%9.1CVE-2019-3858Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker…EPSS 6.4%9.1CVE-2019-3859Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote att…EPSS 6.3%9.1CVE-2019-3862Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no paylo…EPSS 8.1%8.8CVE-2019-3856Libssh2 integer overflow vulnerabilityAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are …EPSS 6.1%8.8CVE-2019-3857Libssh2 integer overflow vulnerabilityAn integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets…EPSS 6.1%

Source: NIST National Vulnerability Database (record CVE-2026-66032), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.