Medium [CVE-2026-66035] Arbitrary code execution via heap buffer overflow during SSH negotiation
This medium-severity Red Hat Linux advisory covers CVE-2026-66035 affecting Red Hat Hardened Images, Red Hat Enterprise Linux 6, Red Hat package: libssh2.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation.
In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.
A flaw was found in libssh2. This allows the server to corrupt heap memory, potentially leading to arbitrary code execution on the connecting client before authentication is complete.
During Encrypt-then-MAC (ETM) cipher negotiation, a specially crafted packet can corrupt heap memory, potentially leading to arbitrary code execution. Exploitation requires a client to connect to a compromised server, limiting the attack surface.
Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-120.
Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 6.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
- 1.11.1
- libssh2-main-1.11.1-10.3.hum1
- RHSA-2026:46955
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
Mitigation checklist
- To reduce exposure, restrict SSH client connections to only trusted and verified SSH servers. Avoid initiating SSH connections to unknown or unverified hosts, as successful exploitation requires the client to connect to a malicious server.
Official advisory · high-confidence parse· fetched 8 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.