CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open()
A malicious SSH server can trigger a double-free in libssh2's sftp_open function, leading to heap corruption and potential remote code execution on the client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-66032?
CVE-2026-66032 is a high-severity use after free vulnerability in libssh2, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
Weakness: CWE-415
Which versions are affected by CVE-2026-66032?
It affects 1 product.
Products include Libssh2 Libssh2.
How do I fix CVE-2026-66032?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-66032 being exploited?
There is no known exploitation of CVE-2026-66032 in the wild and no public exploit code.
Other vulnerabilities in libssh2
- CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
- CVE-2026-66033 libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
- CVE-2026-58050 libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
- CVE-2026-58051 libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
- CVE-2025-15661 libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c
Sources
Also known as ALPINE-CVE-2026-66032, AZL-93396, BELL-CVE-2026-66032, CLSA-2026-1786447189, CLSA-2026-1786478067, CLSA-2026-1786526353 and 10 more.