CVE-2026-66034 libssh2 Heap Out-of-Bounds Read via publickey subsystem
A malicious SSH server can trigger a heap out-of-bounds read and free of an uninitialized pointer in libssh2, leaking heap pointers and corrupting memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-66034?
CVE-2026-66034 is a high-severity memory corruption vulnerability in libssh2, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.
Which versions are affected by CVE-2026-66034?
It affects 1 product.
Products include Libssh2 Libssh2.
How do I fix CVE-2026-66034?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-66034 being exploited?
There is no known exploitation of CVE-2026-66034 in the wild and no public exploit code.
Other vulnerabilities in libssh2
- CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
- CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open()
- CVE-2026-66033 libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
- CVE-2026-58050 libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
- CVE-2026-58051 libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
Sources
Also known as ALPINE-CVE-2026-66034, AZL-93393, AZL-97410, BELL-CVE-2026-66034, DEBIAN-CVE-2026-66034, ECHO-3f90-0490-a5db and 4 more.