CVE-2026-66035

A flaw was found in libssh2. A malicious SSH server can exploit a pre-authentication heap buffer overflow vulnerability by sending a specially crafted packet during the Encrypt-then-MAC (ETM) cipher negotiation. This allows the server to corrupt heap memory, potentially leading to arbitrary code execution on the connecting client before authentication is complete.

This Moderate impact flaw in libssh2 allows a malicious SSH server to trigger a pre-authentication heap buffer overflow on a connecting client. During Encrypt-then-MAC (ETM) cipher negotiation, a specially crafted packet can corrupt heap memory, potentially leading to arbitrary code execution. Exploitation requires a client to connect to a compromised server, limiting the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce exposure, restrict SSH client connections to only trusted and verified SSH servers. Avoid initiating SSH connections to unknown or unverified hosts, as successful exploitation requires the client to connect to a malicious server.