libssh EUVD-2026-46266

The specific prerequisite from the description is a channel-lifecycle race: the attacker (the remote SSH peer) must cause data packets to be processed for a channel after that channel has already been closed, so that a channel data callback fires against freed data. This requires an active SSH connection to or from the vulnerable libssh endpoint and control over packet timing/ordering around channel close. Limiting factors: exploitation depends on hitting the narrow post-close processing window, the confirmed impact is availability only (crash/DoS) rather than data compromise, and reliable use-after-free code execution is only a theoretical escalation, not demonstrated. Whether a full SSH authentication is needed first depends on the embedding application's flow - the CVSS PR:N does not confirm pre-authentication reach.

Signals are consistent and point to a moderate, availability-only issue rather than a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects network reachability with only an availability impact - no confidentiality or integrity loss is claimed. EPSS is low at 0.26% (17th percentile), and CISA's SSVC framework rates Exploitation: none, Automatable: no, Technical Impact: partial - meaning no observed exploitation and no reliable mass-automation path. The vulnerability is described as leading primarily to crashes, with use-after-free code execution noted only as a 'possible' escalation, so the practical outcome in most deployments is a denial of service. There is no KEV listing and no public exploit identified at time of analysis. The main caveat: the reachability of the freed-memory path may depend on whether an attacker must first establish an SSH session/channel, which the CVSS PR:N rating does not distinguish - verify against the specific application's authentication flow before assuming pre-auth reach.

A malicious SSH peer (a rogue server against a libssh client, or a connecting client against a libssh server) opens a channel and then arranges to send channel data packets immediately after the channel is closed. The library dispatches the data callback against freed memory, crashing the SSH process and denying service; in principle the use-after-free could be steered toward memory corruption, though no public exploit demonstrating code execution has been identified.