{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/heap-corruption/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-66032"},{"cvss":7.5,"id":"CVE-2026-66035"},{"cvss":7.5,"id":"CVE-2026-66033"},{"cvss":7.5,"id":"CVE-2026-66034"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["libssh2 \u003c= 1.11.1"],"_cs_severities":["high"],"_cs_tags":["ssh","sftp","double-free","vulnerability","libssh2","memory-corruption","rce","DoS","integer-underflow","heap-corruption"],"_cs_type":"advisory","_cs_vendors":["libssh2"],"content_html":"\u003cp\u003eA critical double-free vulnerability, identified as CVE-2026-66032, exists in libssh2 versions up to and including 1.11.1. This flaw resides within the \u003ccode\u003esftp_open()\u003c/code\u003e function in \u003ccode\u003esrc/sftp.c\u003c/code\u003e and can be exploited by a malicious SSH server. When an authenticated client attempts to open an SFTP session to such a server, the server can trigger a heap corruption on the client side. This occurs if the server responds to an \u003ccode\u003eSSH_FXP_OPEN\u003c/code\u003e request with an \u003ccode\u003eSSH_FXP_STATUS\u003c/code\u003e containing \u003ccode\u003eFX_OK\u003c/code\u003e, causing the response data buffer to be freed. If a subsequent \u003ccode\u003esftp_packet_require()\u003c/code\u003e call then returns a specific error like \u003ccode\u003eLIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED\u003c/code\u003e, the same pointer is freed a second time. On glibc systems, this double-free condition can lead to tcache dup, enabling overlapping memory allocations and ultimately function pointer overwrites, which could result in arbitrary code execution on the vulnerable client system.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA malicious SSH server is configured to exploit the libssh2 vulnerability.\u003c/li\u003e\n\u003cli\u003eAn authenticated client using a vulnerable version of libssh2 attempts to connect to the malicious SSH server and initiates an SFTP session via the \u003ccode\u003esftp_open()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe malicious server responds to the client's \u003ccode\u003eSSH_FXP_OPEN\u003c/code\u003e request with an \u003ccode\u003eSSH_FXP_STATUS\u003c/code\u003e packet that includes \u003ccode\u003eFX_OK\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe client-side \u003ccode\u003esftp_open()\u003c/code\u003e function processes this initial response, leading to the first deallocation of the response data buffer.\u003c/li\u003e\n\u003cli\u003eDuring subsequent processing, or due to a crafted response from the malicious server, a call to \u003ccode\u003esftp_packet_require()\u003c/code\u003e for the same buffer returns a specific error, such as \u003ccode\u003eLIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esftp_open()\u003c/code\u003e function attempts to free the already freed response data buffer for a second time, triggering the double-free condition.\u003c/li\u003e\n\u003cli\u003eOn client systems running glibc, this double-free vulnerability can be leveraged to achieve tcache dup, allowing for controlled overlapping memory allocations.\u003c/li\u003e\n\u003cli\u003eAn attacker can then manipulate these memory allocations to overwrite function pointers, ultimately leading to arbitrary code execution on the vulnerable client system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-66032 can lead to heap corruption and function pointer overwrites on the authenticated client system. This memory corruption can be escalated to arbitrary code execution, allowing the malicious SSH server to execute commands with the privileges of the SFTP client process. This poses a significant risk to systems that connect to untrusted SSH servers using vulnerable libssh2 versions, potentially compromising data integrity, confidentiality, and system availability. No specific victim numbers or targeted sectors are currently available.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-66032 immediately by upgrading libssh2 to a version beyond 1.11.1, specifically one that includes commit \u003ccode\u003e5e47761\u003c/code\u003e or later.\u003c/li\u003e\n\u003cli\u003eImplement host-based intrusion detection systems (HIDS) capable of detecting memory corruption anomalies or unusual process behavior following SFTP connections.\u003c/li\u003e\n\u003cli\u003eRestrict SFTP client connections to trusted SSH servers only, especially for clients running vulnerable libssh2 versions.\u003c/li\u003e\n\u003cli\u003eEnable verbose logging for SSH/SFTP client activities and monitor for unexpected client application crashes or unauthorized process launches.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T17:22:29Z","date_published":"2026-07-24T17:20:23Z","id":"https://feed.craftedsignal.io/briefs/2026-07-libssh2-double-free/","summary":"A double-free vulnerability, CVE-2026-66032, in libssh2 versions through 1.11.1 allows a malicious SSH server to corrupt the heap of an authenticated client opening an SFTP session, potentially leading to arbitrary code execution.","title":"CVE-2026-66032 - libssh2 SFTP Double-Free Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-libssh2-double-free/"}],"language":"en","title":"CraftedSignal Threat Feed - Heap-Corruption","version":"https://jsonfeed.org/version/1.1"}