Skip to content

CVE-2026-66032 on CTRL-OS 26.05

Aliases: CVE-2026-66032

Packages: libssh2

Status: In Progress

Advisory Information

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

Updates

2026-08-12 17:50 CEST

Metadata changes:

  • Status for package libssh2: “In Progress” (02fda3ae36d48d19b44538936d0f68808e910509)

(Amended on: 2026-08-12 17:51 CEST)

2026-07-31 18:04 CEST

Metadata changes:

  • Status for package libssh2: “Plausible”

2026-07-31 18:03 CEST

Metadata changes:

  • Status for package libssh2: “New”