CVE-2026-66032: LIBSSH2

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

Affected products

• LIBSSH2 LIBSSH2: up to and including 1.11.1

Published 2026-07-24. Last modified 2026-08-07.