Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-24T16:42:18 libssh2: libssh2: Information disclosure and potential arbitrary code execution via heap out-of-bounds read 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H CWE-125

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

A missing bounds check in the libssh2 publickey subsystem allows malicious SSH servers to trigger a client-side out-of-bounds read, leaking heap pointers that could enable security bypasses, denial of service, or code execution.

This Moderate impact flaw in libssh2 allows a malicious SSH server to trigger an out-of-bounds read on a connecting client. While requiring user interaction to connect to a compromised server and having high attack complexity, successful exploitation could leak heap pointers, potentially aiding in ASLR bypass and leading to arbitrary code execution or denial of service on Red Hat Hardened Images. To mitigate this, strictly avoid connecting to untrusted SSH servers and enforce this policy using outbound network firewalls to block unknown IP addresses. For defense-in-depth, utilize OS-level memory protections and service sandboxing to contain any accidental exposure. Red Hat Hardened Images 2026-07-27T00:00:00Z RHSA-2026:46927 libssh2-main-1.11.1-10.2.hum1 Red Hat Enterprise Linux 6 Out of support scope libssh2 Red Hat Enterprise Linux 7 Affected libssh2 https://www.cve.org/CVERecord?id=CVE-2026-66034 https://nvd.nist.gov/vuln/detail/CVE-2026-66034 https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9 https://github.com/libssh2/libssh2/pull/2202 https://www.vulncheck.com/advisories/libssh2-heap-out-of-bounds-read-via-publickey-subsystem