CVE-2026-66032

A flaw was found in libssh2. A malicious SSH (Secure Shell) server can exploit a double-free vulnerability in the sftp_open() function. This flaw allows the server to corrupt the heap memory of an authenticated client when it opens an SFTP (SSH File Transfer Protocol) session. This heap corruption can lead to arbitrary code execution on the client system, giving the attacker control over the affected system.

Moderate: A double-free vulnerability in libssh2 allows a malicious SSH server to corrupt the heap of an authenticated client during an SFTP session. This flaw requires user interaction, as a client must connect to a specially crafted server and initiate an SFTP transfer, which can lead to arbitrary code execution on the client system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict your libssh2 clients to connect only to fully trusted, internal SFTP servers to eliminate exposure to malicious server responses. Additionally, configure dependent applications with Restart=on-failure in systemd so RHEL's glibc memory protections can safely crash and auto-recover the process during an attack.