CVE-2026-66032: 
Wolfi Analyse et atténuation des vulnérabilités

CVE-2026-66032 is a double-free vulnerability in the sftp_open() function within src/sftp.c of libssh2, a widely used C library for SSH2 protocol support. The flaw affects libssh2 through version 1.11.1 and was disclosed on July 24, 2026, with a fix committed on July 2, 2026 (commit 5e47761). It allows a malicious SSH server to corrupt the heap of any authenticated client that opens an SFTP session. The vulnerability carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, Feedly).

The root cause is a double-free condition (CWE-415) in sftp_open() in src/sftp.c. When a malicious SSH server responds to an SSH_FXP_OPEN request with an SSH_FXP_STATUS message containing FX_OK, the response data buffer is freed. If a subsequent sftp_packet_require() call then returns a specific error — such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED — the same pointer is freed a second time without having been nullified. On glibc-based systems, this enables tcache dup conditions, allowing overlapping heap allocations and function pointer overwrites, ultimately enabling remote code execution. The fix (PR #2180) adds a single line setting data = NULL immediately after the first SSH2_FREE() call to prevent the dangling pointer from being freed again (libssh2 PR #2180, libssh2 commit).

Successful exploitation allows an attacker-controlled SSH server to corrupt the heap of any libssh2 client process that connects and opens an SFTP session, with potential for arbitrary code execution at the privilege level of the client process. This results in full compromise of confidentiality, integrity, and availability of the affected client system. Any application or tool that uses libssh2 for SFTP operations — including file transfer utilities, deployment tools, and automation frameworks — is at risk when connecting to untrusted or attacker-controlled SSH servers (Github Advisory, Feedly).

1. Set up a malicious SSH server: The attacker deploys a custom SSH server (e.g., a modified OpenSSH or a purpose-built server) capable of crafting arbitrary SFTP protocol responses.
2. Lure the victim client: The attacker tricks a user or automated process running a libssh2-based application (e.g., an SFTP client, deployment tool) into connecting to the malicious server — via phishing, DNS poisoning, BGP hijacking, or misconfigured SSH host keys.
3. Complete SSH authentication: The client authenticates to the malicious server normally; the server accepts the connection.
4. Trigger the double-free: When the client calls sftp_open() to open a file over SFTP, the malicious server responds to SSH_FXP_OPEN with an SSH_FXP_STATUS message containing FX_OK. The libssh2 client frees the response data buffer. The server then causes sftp_packet_require() to return LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, triggering a second free() on the same pointer.
5. Exploit tcache dup: On glibc systems, the double-free creates a tcache dup condition, allowing the attacker to craft subsequent heap allocations that overlap with sensitive memory regions, including function pointers.
6. Achieve code execution: By controlling heap layout through carefully timed allocations, the attacker overwrites a function pointer and redirects execution to attacker-controlled code, running with the privileges of the client process (Github Advisory, libssh2 PR #2180).

• Network: Outbound SSH/SFTP connections (TCP port 22) from client systems to unexpected or newly observed IP addresses; connections to SSH servers with unrecognized or self-signed host keys.
• Process: Unexpected child processes spawned by applications using libssh2 (e.g., file transfer tools, CI/CD agents); crashes or segmentation faults in libssh2-linked applications during SFTP session establishment.
• Logs: Application logs showing SFTP session errors such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED immediately after a successful SSH_FXP_OPEN exchange; repeated SFTP open failures against the same remote host.
• File System: Unexpected new files, scripts, or binaries written by processes that use libssh2 for SFTP; core dump files from libssh2-linked applications in /var/crash/ or application working directories.

The fix is available in commit 5e4776146552d898b9c0e1b313cd093fa8dc92d0 (merged July 2, 2026 via PR #2180); users should update libssh2 to a version containing this commit or later. As a workaround, avoid connecting libssh2-based applications to untrusted or unverified SSH servers, and enforce strict SSH host key verification to reduce the risk of connecting to a malicious server. Organizations should audit all software dependencies that bundle or link against libssh2 ≤ 1.11.1 and prioritize patching for internet-facing or automated SFTP workflows (libssh2 commit, Github Advisory).

The vulnerability was discovered and reported by VladimirEliTokarev, with credit noted in the fix commit. VulnCheck published an advisory covering the technical details of the heap corruption mechanism. Coverage has appeared on The Hacker Wire and several CVE aggregation platforms shortly after disclosure, reflecting moderate community interest given the library's widespread use in SSH/SFTP tooling (The Hacker Wire, VulnCheck Advisory).