Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-28T01:32:53 libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H CWE-787

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.

A flaw in libssh2 allows a malicious SSH server to trigger a memory overflow by sending a manipulated attribute count. This can cause the connecting client to crash or allow unauthorized code execution.

This Moderate impact flaw in libssh2 allows a malicious SSH server to trigger a heap buffer overflow in a connecting client. By manipulating the publickey-subsystem response, an attacker could cause an integer overflow, potentially leading to denial of service or arbitrary code execution on Red Hat systems using libssh2 to establish SSH connections. Note: Red Hat Enterprise Linux (RHEL) 8 and newer are not affected by this flaw, as they do not ship the libssh2 package. To mitigate this issue,ensure your applications are running strictly on 64-bit architectures, which naturally prevents the integer overflow from occurring. Additionally, configure your applications to connect only to trusted, verified SSH servers. Red Hat Enterprise Linux 6 Out of support scope libssh2 Red Hat Enterprise Linux 7 Affected libssh2 Red Hat Hardened Images Affected libssh2 https://www.cve.org/CVERecord?id=CVE-2026-58050 https://nvd.nist.gov/vuln/detail/CVE-2026-58050 https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc https://github.com/libssh2/libssh2/blob/master/src/publickey.c https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation