CVE-2026-66032 @ Helios

"CVE-2026-66032"
"libssh2-1-1.9.0-2+deb11u1"
"libssh2-1"
"Am I vulnerable?"

Status

accepted_risk

Priority

1.32

Match score

4.0

Risk

MemCorrupt Remote priv:user

CVSS

8.8 HIGH

Reason

cpe: libssh2; pkgs: libssh2-1; version: in-range: libssh2-1-1.9.0-2+deb11u1; debian:bullseye libssh2 open; risk:memory_corruption

Created

2026-08-07T10:15:38Z

Updated

2026-08-22T10:16:19Z

Closed

2026-08-07T15:16:43Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
libssh2-1-1.9.0-2+deb11u1
libssh2-1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: libssh2 · libssh2-1

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2026-66033	7.5	Helios, morris, mufasa	accepted_risk	libssh2	—
CVE-2026-66034	7.5	Helios, morris, mufasa	accepted_risk, not_applicable	libssh2	→ CVE-2026-66033
CVE-2026-66035	7.5	morris, mufasa	not_applicable	libssh2	→ CVE-2026-66033

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 11 (bullseye) (11) · debian

Arch

aarch64

kernel_release

uname -r → 6.1.21-v8+

kernel_version

uname -v → #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	accepted_risk	8.8	2026-08-22T10:16:19Z	Open
mufasa	accepted_risk	8.8	2026-08-22T10:16:19Z	Open

Description

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

Determination

Summary of the issue

CVE-2026-66032 — Double-free in sftp_open()
Affects all libssh2 ≤ 1.11.1
Requires the client to connect to a malicious SSH server and open an SFTP session
Can lead to heap corruption / potential code execution in the client process
No public access
Only monitors owned / controlled servers
Zero Risk of Exposure

Update status

Add note only

Mitigation log

2026-08-07T15:15:25Z — affects

Summary of the issue CVE-2026-66032 — Double-free in sftp_open() Affects all libssh2 ≤ 1.11.1 Requires the client to connect to a malicious SSH server and open an SFTP session Can lead to heap corruption / potential code execution in the client process

2026-08-07T15:16:43Z — accepted_risk

No public access Only monitors owned / controlled servers Zero Risk of Exposure

References

NVD: CVE-2026-66032