Skip to main content

libssh2 EUVDEUVD-2026-39970

| CVE-2026-58050 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-06-28 VulnCheck GHSA-mf77-5hj2-98w9
Integer Overflow Buffer Overflow Libssh2 Red Hat Suse
8.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.0 HIGH

Network-reachable from a malicious server with no client credentials (PR:N), but AC:H because only 32-bit builds overflow and the victim must connect to the attacker; impact is mainly availability (heap corruption).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jun 28, 2026 - 02:30 vuln.today
CVSS changed
Jun 28, 2026 - 02:22 NVD
7.0 (HIGH) 8.3 (HIGH)

DescriptionCVE.org

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.

AnalysisAI

Heap buffer overflow in the libssh2 SSH client library (all versions through 1.11.1) lets a malicious or compromised SSH server corrupt memory in any connecting client on 32-bit platforms. The publickey subsystem reads an attacker-supplied 32-bit attribute count and multiplies it by the attribute structure size without bounds checking, so the allocation integer-overflows to an undersized buffer that the parsing loop then writes past. Publicly available exploit code exists; this is a CWE-190 integer overflow with no public exploit identified in CISA KEV, so it is not confirmed actively exploited.

Technical ContextAI

libssh2 is a widely embedded client-side C library implementing the SSH2 protocol, used by tools such as curl/libcurl for SCP/SFTP and by many applications that programmatically open SSH sessions. The flaw lives in the publickey subsystem handler (src/publickey.c) where the server-returned response carries a 32-bit num_attrs value. That value feeds an allocation sized as num_attrs * sizeof(libssh2_publickey_attribute); on 32-bit (ILP32) targets the product wraps around the 32-bit size_t, returning a buffer far smaller than the loop expects. This is a textbook CWE-190 integer overflow leading to an undersized allocation and subsequent out-of-bounds heap writes during attribute parsing. Per the CPE cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* the issue is in the upstream library itself, so it transitively affects every product that statically or dynamically links a vulnerable libssh2 build on a 32-bit architecture.

RemediationAI

No vendor-released patched version is identified in the supplied data, so monitor the libssh2 project and the VulnCheck advisory (https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation) for a tagged release that adds bounds checking to the num_attrs allocation, and upgrade as soon as it ships. As compensating controls until then: prefer 64-bit builds of libssh2 and any software linking it, since the overflow does not trigger on 64-bit size_t - the trade-off is that 32-bit-only embedded/legacy targets cannot adopt this and need replacement or rebuild. Restrict outbound SSH connections from libssh2-based clients to known, trusted hosts (host allowlisting or egress filtering) so a malicious server cannot be reached; the side effect is reduced flexibility for ad-hoc connections. Where possible, avoid or disable use of the publickey subsystem code path in applications that do not require it, accepting loss of that feature. Track and rebuild any first-party software that statically links libssh2 once a fix lands, since OS package updates will not cover statically embedded copies.

More in Libssh2

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2026-55200 CRITICAL POC
9.2 Jun 17

Remote code execution in libssh2 through version 1.11.1 stems from an unchecked packet_length field in ssh2_transport_re
CVE-2026-58051 HIGH POC
8.3 Jun 28

Free of an uninitialized, attacker-influenceable pointer in libssh2 through 1.11.1 allows a malicious SSH server to corr
CVE-2019-17498 HIGH POC
8.1 Oct 21

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds che
CVE-2019-13115 HIGH POC
8.1 Jul 16

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow t
CVE-2019-3861 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gre
CVE-2019-3860 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed
CVE-2019-3858 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from

CVE-2019-3862 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exi
CVE-2019-3859 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_req
CVE-2019-3857 HIGH
8.8 Mar 25

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SS
CVE-2019-3856 HIGH
8.8 Mar 25

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

Debian

libssh2
Release Status Fixed Version Urgency
bullseye vulnerable 1.9.0-2+deb11u1 -
bookworm vulnerable 1.10.0-3 -
trixie vulnerable 1.11.1-1 -
trixie (security) vulnerable 1.11.1-1+deb13u1 -
forky, sid vulnerable 1.11.1-4 -
(unstable) fixed (unfixed) -

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

EUVD-2026-39970 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy