Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-24T16:45:24 libssh2: libssh2: Arbitrary code execution via heap buffer overflow during SSH negotiation 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-120

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.

A flaw was found in libssh2. A malicious SSH server can exploit a pre-authentication heap buffer overflow vulnerability by sending a specially crafted packet during the Encrypt-then-MAC (ETM) cipher negotiation. This allows the server to corrupt heap memory, potentially leading to arbitrary code execution on the connecting client before authentication is complete.

This Moderate impact flaw in libssh2 allows a malicious SSH server to trigger a pre-authentication heap buffer overflow on a connecting client. During Encrypt-then-MAC (ETM) cipher negotiation, a specially crafted packet can corrupt heap memory, potentially leading to arbitrary code execution. Exploitation requires a client to connect to a compromised server, limiting the attack surface. To reduce exposure, restrict SSH client connections to only trusted and verified SSH servers. Avoid initiating SSH connections to unknown or unverified hosts, as successful exploitation requires the client to connect to a malicious server. Red Hat Hardened Images 2026-07-27T00:00:00Z RHSA-2026:46955 libssh2-main-1.11.1-10.3.hum1 Red Hat Enterprise Linux 6 Out of support scope libssh2 Red Hat Enterprise Linux 7 Affected libssh2 https://www.cve.org/CVERecord?id=CVE-2026-66035 https://nvd.nist.gov/vuln/detail/CVE-2026-66035 https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 https://github.com/libssh2/libssh2/pull/2198 https://www.vulncheck.com/advisories/libssh2-heap-buffer-overflow-via-etm-cipher-negotiation