Intel

CVE-2026-66035

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

highEPSS 0.5%

Affected

  • ubuntu/libssh2 1.11.0-4.1ubuntu0.24.04.4..*
  • ubuntu/libssh2 1.11.1-1ubuntu0.26.04.4..*

Description

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.

Source: suse_csafUbuntu Security NoticesBSI WID PortalBSI CSAFredhat_csafMicrosoft Security Update GuideNVD (NIST)cvelistv5CVE.org (MITRE)

Affected operating systems

  • linux

    ubuntu / libssh2noble

  • linux

    ubuntu / libssh2resolute

Metrics

XIEM Effective CVSS
7.7
Source: nvd-v4
EPSS percentile
38.9 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
73.97
Exploit maturity
no public PoC known
CVSS v3
7.5
CVSS v4
7.7
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-27 19:37 UTC
CWE
CWE-122

Weakness classes (CWE)

  • CWE-122Variant

    Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-07-30 15:41 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* versions up to (including) 1.11.1
    • Reference Type: VulnCheck: https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Types: Patch
    • Reference Type: VulnCheck: https://github.com/libssh2/libssh2/pull/2198 Types: Issue Tracking, Patch
    • Reference Type: VulnCheck: https://www.vulncheck.com/advisories/libssh2-heap-buffer-overflow-via-etm-cipher-negotiation Types: Patch, Third Party Advisory
  2. CVE Modified2026-07-25 05:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-66035","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI… → {"id":"CVE-2026-66035","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…

Linked advisories