CVE-2026-66035

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1

Description A pre-authentication heap buffer overflow occurs during Encrypt-then-MAC (ETM) cipher negotiation. A malicious SSH server can corrupt heap metadata in a connecting client by sending a packet where the packet length is smaller than the cipher's block size. In the fullpacket() function within src/transport.c, the ETM path allocates a buffer based on packet length but copies blocksize minus one bytes using memcpy. On 32-bit glibc, this allows an attacker to write controlled bytes into the SIZE field of an adjacent chunk, potentially leading to tcache bin confusion, overlapping live objects, and function pointer overwrites during the session handshake.

Recommendations Update libssh2 to the version containing commit 42e33d8.