Loading vulnerability…
Double-free in libssh2 sftp_open()
CVE-2026-66032 is a double-free vulnerability in the sftp_open() function in libssh2 through version 1.11.1. A malicious SSH server can trigger the flaw when an authenticated client performs an SFTP open operation. If the server answers SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, libssh2 frees the response buffer. A subsequent sftp_packet_require() failure, such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, can cause the same pointer to be freed again. This corrupts the client heap and, on glibc systems, may enable tcache duplication, overlapping allocations, and function-pointer overwrites, potentially resulting in arbitrary code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker controlling a server contacted by a vulnerable libssh2 client can crash the client application or potentially execute arbitrary code in its process context. Successful code execution could compromise data and operations accessible to that process. The glibc exploitation mechanism can produce overlapping heap allocations and function-pointer overwrites; code execution is a potential outcome rather than a guaranteed consequence of every trigger.
If you can’t patch tonight, do this now.
Until patched, avoid connecting libssh2-based clients to untrusted SSH/SFTP servers and restrict outbound SSH/SFTP connections to trusted, authenticated servers. These restrictions reduce exposure but do not correct the memory-management flaw.
Patch, then assume compromise.
Update libssh2 to a build containing upstream fix commit 5e47761, or apply that patch and rebuild. Update or rebuild applications that statically bundle libssh2, because updating the system library alone does not remediate those copies. Distribution fixes include Debian 12 package version 1.10.0-3+deb12u1, Alpine version 1.11.1-r4 or later, Ubuntu 24.04 LTS libssh2-1t64 version 1.11.0-4.1ubuntu0.24.04.4, and Ubuntu 26.04 LTS libssh2-1t64 version 1.11.1-1ubuntu0.26.04.4. For other distributions, install the applicable vendor security update. Test SFTP functionality after patching.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.