libssh2 Fixes High-Severity Double-Free in `sftp_open()`
Vulnerability Disclosure · 6 sources · Updated 3mo ago · First seen Jul 24, 2026
A high-severity memory-safety flaw tracked as CVE-2026-66032 was disclosed in libssh2 through version 1.11.1, affecting the sftp_open() function in src/sftp.c. The bug allows a malicious SSH server to trigger a double free in an authenticated client that opens an SFTP session, creating heap corruption conditions. Advisory details say the issue occurs when the server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK and a later sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, causing the same response buffer to be freed twice.
The libssh2 project addressed the flaw in commit 5e4776146552d898b9c0e1b313cd093fa8dc92d0, merged through pull request #2180, by nullifying the pointer after it is freed in the SFTP code. The fix, which also resolves advisory GHSA-px3w-7g75-hg7w, credits VladimirEliTokarev for reporting the issue. Security writeups warn that on glibc-based systems the bug can produce tcache-dup style heap corruption, potentially enabling overlapping allocations and function pointer overwrites, and users are advised to update libssh2 or apply the patch and recompile.
