Intel

CVE-2026-66034

libssh2: Lesezugriff ausserhalb der Grenzen

highEPSS 0.4%

Affected

  • libssh2/libssh2 between *..1.11.1

Description

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

Source: suse_csafUbuntu Security NoticesBSI WID PortalBSI CSAFMicrosoft Security Update GuideNVD (NIST)cvelistv5CVE.org (MITRE)

Affected operating systems

  • linux

    ubuntu / libssh2bionic

  • linux

    ubuntu / libssh2focal

  • linux

    ubuntu / libssh2jammy

  • linux

    ubuntu / libssh2trusty

  • linux

    ubuntu / libssh2xenial

Metrics

XIEM Effective CVSS
7.7
Source: nvd-v4
EPSS percentile
32.4 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
high
Priority score
69.99
Exploit maturity
no public PoC known
CVSS v3
7.5
CVSS v4
7.7
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-24 17:17 UTC
CWE
CWE-125, CWE-908

Weakness classes (CWE)

  • CWE-125Base

    Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

    cwe.mitre.org →

  • CWE-908Base

    Use of Uninitialized Resource

    The product uses or accesses a resource that has not been initialized.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-07-30 15:44 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* versions up to (including) 1.11.1
    • Reference Type: VulnCheck: https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9 Types: Patch
    • Reference Type: VulnCheck: https://github.com/libssh2/libssh2/pull/2202 Types: Issue Tracking, Patch
    • Reference Type: VulnCheck: https://www.vulncheck.com/advisories/libssh2-heap-out-of-bounds-read-via-publickey-subsystem Types: Patch, Third Party Advisory
  2. CVE Modified2026-07-25 05:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-66034","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI… → {"id":"CVE-2026-66034","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…

Linked advisories