Attack Chain

1. A malicious SSH server is configured to exploit the libssh2 vulnerability.
2. An authenticated client using a vulnerable version of libssh2 attempts to connect to the malicious SSH server and initiates an SFTP session via the sftp_open() function.
3. The malicious server responds to the client's SSH_FXP_OPEN request with an SSH_FXP_STATUS packet that includes FX_OK.
4. The client-side sftp_open() function processes this initial response, leading to the first deallocation of the response data buffer.
5. During subsequent processing, or due to a crafted response from the malicious server, a call to sftp_packet_require() for the same buffer returns a specific error, such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED.
6. The sftp_open() function attempts to free the already freed response data buffer for a second time, triggering the double-free condition.
7. On client systems running glibc, this double-free vulnerability can be leveraged to achieve tcache dup, allowing for controlled overlapping memory allocations.
8. An attacker can then manipulate these memory allocations to overwrite function pointers, ultimately leading to arbitrary code execution on the vulnerable client system.

Impact

Successful exploitation of CVE-2026-66032 can lead to heap corruption and function pointer overwrites on the authenticated client system. This memory corruption can be escalated to arbitrary code execution, allowing the malicious SSH server to execute commands with the privileges of the SFTP client process. This poses a significant risk to systems that connect to untrusted SSH servers using vulnerable libssh2 versions, potentially compromising data integrity, confidentiality, and system availability. No specific victim numbers or targeted sectors are currently available.

Recommendation

• Patch CVE-2026-66032 immediately by upgrading libssh2 to a version beyond 1.11.1, specifically one that includes commit 5e47761 or later.
• Implement host-based intrusion detection systems (HIDS) capable of detecting memory corruption anomalies or unusual process behavior following SFTP connections.
• Restrict SFTP client connections to trusted SSH servers only, especially for clients running vulnerable libssh2 versions.
• Enable verbose logging for SSH/SFTP client activities and monitor for unexpected client application crashes or unauthorized process launches.