CVE-2026-66034

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1

Description A missing bounds check in the publickey subsystem allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and the free of an uninitialized pointer. In the libssh2 publickey list fetch() function, the version 1 response parser reads a server-controlled comment len value and advances the parse pointer without verifying if sufficient bytes remain in the buffer. This leads to an out-of-bounds read that can leak heap pointers from adjacent allocations, defeating ASLR (Address Space Layout Randomization, a security technique that randomly arranges the address space positions of key data areas). Subsequently, heap allocator state corruption occurs when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

Recommendations Update to the version containing commit a13bb6c.