libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH FXP OPEN with SSH FXP STATUS containing FX OK, the response data buffer is freed, and if a subsequent sftp packet require() call returns a specific error such as LIBSSH2 ERROR CHANNEL PACKET EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.