CVE-2026-66035 libssh2 Heap Buffer Overflow via ETM Cipher Negotiation
A malicious SSH server can trigger a heap buffer overflow in libssh2 clients during handshake, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-66035?
CVE-2026-66035 is a high-severity memory corruption vulnerability in libssh2, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.
Weakness: CWE-122
Which versions are affected by CVE-2026-66035?
It affects 1 product.
Linux distribution packages (3)
libssh2 Red Hat:hummingbird:1 | All versions | 0:1.11.1-10.3.hum1 |
libssh2-devel Red Hat:hummingbird:1 | All versions | 0:1.11.1-10.3.hum1 |
libssh2-docs Red Hat:hummingbird:1 | All versions | 0:1.11.1-10.3.hum1 |
Products include Libssh2 Libssh2.
How do I fix CVE-2026-66035?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-66035 being exploited?
There is no known exploitation of CVE-2026-66035 in the wild and no public exploit code.
Other vulnerabilities in libssh2
- CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
- CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open()
- CVE-2026-66033 libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
- CVE-2026-58050 libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
- CVE-2026-58051 libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
Sources
Also known as ALPINE-CVE-2026-66035, AZL-93399, BELL-CVE-2026-66035, DEBIAN-CVE-2026-66035, ECHO-a13b-3527-8590, GHSA-v6rf-8q4r-r495 and 4 more.