CVE-2026-66034— libssh2 Heap Out-of-Bounds Read via publickey subsystem
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-66034
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
libssh2 Heap Out-of-Bounds Read via publickey subsystem
Source: CVE Program / CVE List V5
Vulnerability Description
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-66034
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8326 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-66034
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-66034 (2)
Vendor Advisories for CVE-2026-66034 (1)
Same Patch Batch · libssh2 · 2026-07-24 · 4 CVEs total
| CVE-2026-66032 | 8.8 HIGH | libssh2 Double-Free Heap Corruption via sftp_open() |
| CVE-2026-66033 | 7.5 HIGH | libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation |
| CVE-2026-66035 | 7.5 HIGH | libssh2 Heap Buffer Overflow via ETM Cipher Negotiation |
IV. Related Vulnerabilities
Same product: libssh2
- CVE-2026-66035
libssh2 Heap Buffer Overflow via ETM Cipher Negotiation - CVE-2026-66033
libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation - CVE-2026-66032
libssh2 Double-Free Heap Corruption via sftp_open() - CVE-2026-58051
libssh2 - Free of Uninitialized Pointer in publickey List Cl - CVE-2026-58050
libssh2 - Integer Overflow in publickey Subsystem Attribute
Same vendor: libssh2
- CVE-2026-66035
libssh2 Heap Buffer Overflow via ETM Cipher Negotiation - CVE-2026-66033
libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation - CVE-2026-66032
libssh2 Double-Free Heap Corruption via sftp_open() - CVE-2026-58050
libssh2 - Integer Overflow in publickey Subsystem Attribute - CVE-2026-58051
libssh2 - Free of Uninitialized Pointer in publickey List Cl
Same weakness: CWE-125
- CVE-2026-66337
Libsoup: libsoup: heap buffer over-read via integer underflo - CVE-2026-55732
Loytec LINX firmware: Out-of-bounds Read in BACnet packet pa - CVE-2026-56391
Out‑of‑bounds Read in GNU coreutils - CVE-2026-16002
Out-of-bounds Read in MZ Automation lib60870 - CVE-2026-65918
PyTorch torchvision GIF Decoder Out-of-bounds Heap Read
V. Comments for CVE-2026-66034
No comments yet