THREAT INTELLIGENCE REPORT — CVE-2026-66032

Executive Summary

CVE-2026-66032 is a double-free heap corruption vulnerability in the sftp_open() function within src/sftp.c of libssh2, affecting all versions through 1.11.1. A malicious SSH server can exploit this flaw against any authenticated client that opens an SFTP session, achieving heap corruption that may lead to arbitrary code execution within the context of the client application. With a CVSS score of 8.8, this vulnerability is rated High severity, and a patch exists in commit 5e47761.

Technical Analysis

The vulnerability resides in libssh2's SFTP subsystem, specifically within the sftp_open() function implemented in src/sftp.c. The NVD description reveals a double-free condition triggered through the following mechanism:

The attack requires a malicious SSH server to respond to an SSH_FXP_OPEN request with an SSH_FXP_STATUS packet that contains the status code FX_OK. Normally, a successful open operation should return SSH_FXP_HANDLE, but this malicious server instead returns a status packet with a success code — an anomalous but protocol-valid response that libssh2's code does not adequately handle.

The vulnerability unfolds in the following manner:

1. The client application calls sftp_open() to establish an SFTP session and open a remote file.
2. The client sends an SSH_FXP_OPEN packet to the server.
3. The malicious server responds with SSH_FXP_STATUS containing FX_OK (success).
4. The libssh2 code processes this response, and at some point during handling, frees the response data buffer that holds the received packet.
5. A subsequent internal call to sftp_packet_require() is made — this function expects to retrieve the next SFTP packet from the server. Under normal circumstances this would return the SSH_FXP_HANDLE response.
6. When the server causes sftp_packet_require() to return a specific error condition — LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED — the code path frees the same pointer that was already freed in step 4.
7. This second free of an already-freed pointer constitutes the double-free condition.

On glibc-based systems, this double-free triggers a "tcache dup" condition. The glibc tcache (thread-local cache) mechanism, introduced in glibc 2.26, maintains a per-thread cache of freed chunks. When the same chunk is freed twice without an intervening allocation, it creates a duplicate entry in the tcache freelist. This allows an attacker to obtain two overlapping allocations from the heap, which can be leveraged to perform overlapping allocation attacks — potentially overwriting function pointers or other sensitive heap metadata to achieve arbitrary code execution.

The attack surface is specifically the SFTP subsystem of libssh2. Any application that uses libssh2 to connect to a remote SSH server and subsequently opens an SFTP session is vulnerable, provided the connecting client can be directed to a malicious or compromised SSH server.

The CWE-415 classification (Double Free) is appropriate, as the vulnerability involves freeing the same memory region twice without proper reinitialization.

Exploitation Scenarios

The exploitation chain for CVE-2026-66032 proceeds as follows:

Phase 1 — Target Acquisition and Reconnaissance: An attacker identifies targets that use libssh2 with SFTP functionality. This includes applications such as: file transfer clients, backup utilities, CI/CD pipelines, embedded devices with SFTP sync capabilities, and any DevOps tooling that connects to SSH/SFTP servers. The attacker may use Shodan or other internet scanning platforms to identify SSH servers running libssh2 (via SSH banner fingerprinting), or they may target high-value organizations where they can position a malicious SSH server within a network path.

Phase 2 — Malicious SSH Server Deployment: The attacker stands up a rogue SSH server (e.g., using a modified OpenSSH or a custom implementation) that behaves normally for the SSH transport and authentication phases to establish a legitimate session with the client. Once authentication succeeds and the client initiates an SFTP session, the malicious server deviates from expected behavior.

Phase 3 — Trigger: When the client calls sftp_open() (the libssh2 API call that maps to the SFTP SSH_FXP_OPEN request), the malicious server responds with an SSH_FXP_STATUS packet carrying FX_OK instead of the expected SSH_FXP_HANDLE. The malicious server then also causes the subsequent sftp_packet_require() call to return LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED. This is achieved by sending an oversized SFTP packet that exceeds the channel's maximum packet size, or by truncating a channel data stream in a way that makes the packet size field exceed the allowed limit.

Phase 4 — Double-Free Execution: The first free occurs when libssh2 processes the unexpected FX_OK status response. The second free occurs when sftp_packet_require() fails with the specific error. This triggers the tcache dup condition in glibc, corrupting the heap's tcache freelist.

Phase 5 — Post-Exploitation: The attacker achieves overlapping heap allocations. With this primitive, the attacker crafts heap spraying payloads to overwrite function pointers (e.g., in structures such as LIBSSH2_SFTP, LIBSSH2_CHANNEL, or application-level vtables) with addresses pointing to attacker-controlled shellcode or ROP chains. Successful exploitation results in arbitrary code execution in the context of the client process, allowing the attacker to exfiltrate data, install persistence mechanisms, or pivot laterally within the client's network.

Realistic Attack Scenario: An organization's backup solution runs nightly as a privileged service and connects to a remote SFTP server for off-site replication. An attacker compromises the remote backup server (or performs a man-in-the-middle attack on the backup connection) and executes this exploit against the backup client, gaining code execution on the backup host with the privileges of the backup service (potentially root or SYSTEM).

Impact Assessment

CVSS Breakdown: The vulnerability scores 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H:

• Attack Vector: Network (AV:N) — Exploitation occurs over the network via SSH protocol.
• Attack Complexity: Low (AC:L) — No special conditions are required; the attack pattern is straightforward.
• Privileges Required: None (PR:N) — The attacker needs no prior authentication or access.
• User Interaction: Required (UI:R) — The victim client must be tricked (e.g., social engineering or DNS poisoning) into connecting to the malicious server and opening an SFTP session.
• Confidentiality/Integrity/Availability: High (C:H/I:H/A:H) — Full compromise of the client system.

Business Impact:

• Lateral Movement Vector: Successful exploitation provides code execution on client systems, enabling attackers to pivot and compromise additional network assets.
• Data Exposure: Backup clients, CI/CD pipelines, and file-sync applications often have elevated privileges and access to sensitive repositories — all of which become exposed.
• Supply Chain Risk: Development tools using libssh2 for artifact distribution may be compromised, poisoning the software supply chain.

Affected Systems: All libssh2 versions up to and including 1.11.1. Ephemeral OSV package data confirms an unfixed package variant (kernel and deployment environments using libssh2 in container images, embedded Linux, and enterprise software distribution channels).

Blast Radius: Extremely broad due to libssh2's widespread integration across ecosystems: Linux distributions (embedded in curl, git, and OpenSSH toolsets), Windows applications, macOS ports, FreeBSD, Python bindings (paramiko uses cryptography's SSH layer, but other Python libs wrap libssh2), and Rust/Go bindings.

Detection Guidance

Sigma Rule

title: CVE-2026-66032 Libssh2 SFTP Double-Free Exploitation Attempt
id: 7f2c0a1e-5b3d-4a8e-9c1f-3d2e8a5b6c74
status: experimental
description: Detects anomalous SFTP session behavior indicative of CVE-2026-66032 exploitation — specifically, SFTP server responses returning FX_OK for OPEN requests followed by channel packet size errors.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66032
author: Threat Intelligence Team
date: 2026/01/15
logsource:
    category: application
    product: libssh2
    definition: Application must log SFTP traffic and channel errors.
detection:
    selection_fx_ok:
        sfpt_status: "FX_OK"
        sftp_request: "SSH_FXP_OPEN"
    selection_error:
        libssh2_error: "LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED"
    condition: selection_fx_ok and selection_error
level: high
falsepositives:
    - Legitimate servers might occasionally return unusual status codes, but the combination with channel packet errors is highly suspicious.

YARA Rule

rule CVE_2026_66032_Libssh2_SFTP_Double_Free
{
    meta:
        author = "Threat Intelligence Team"
        date = "2026-01-15"
        description = "Detects vulnerable libssh2 source code pattern in src/sftp.c — double-free pattern in sftp_open()"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-66032"
        severity = "high"
    strings:
        $s1 = "sftp_open" ascii wide
        $s2 = "SSH_FXP_STATUS" ascii wide
        $s3 = "FX_OK" ascii wide
        $s4 = "sftp_packet_require" ascii wide
        $s5 = "LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED" ascii wide
        $s6 = "LIBSSH2_FREE" ascii wide
    condition:
        uint16(0) == 0x5A4D and filesize < 2MB and all of them
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-66032 Potential libssh2 SFTP Double-Free Exploitation Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|00 00 00 03|"; distance:0; within:4; content:"SSH_FXP_OPEN"; distance:0; within:64; flow:to_client,established; content:"|00 00 00 03|"; within:4; reference:cve,2026-66032; classtype:attempted-admin; sid:2026066032; rev:1;)

This rule looks for SSH_FXP_OPEN requests (packet type 3) followed by responses with status-type packets (packet type 3) that deviate from expected handle responses. The rule is designed to catch the anomalous server behavior where SSH_FXP_STATUS with FX_OK is returned for an open request.

Elastic Detection

sequence by host.name with maxspan=30s
  [network where protocol == "ssh" and 
   event.action in ("connect","session") and 
   source.port == 22 or destination.port == 22]
  [process where event.action == "exec" and 
   process.name in ("curl","git","sftp","scp","ssh","lftp","winscp")]
  [file where event.action in ("modify","create") and 
   process.name in ("curl","git","sftp","scp","ssh","lftp","winscp") and 
   file.name : ("*.txt","*.tar","*.zip","*.cfg")]

This sequence-based rule attempts to capture the entire exploitation chain: network connection to a potentially malicious SSH server, execution of a libssh2-using client process, and subsequent file operations that may indicate the attacker's payload being written to disk.

Splunk SPL Query

index=main sourcetype=ssh_logs OR sourcetype=libssh2_logs
| search (sftp_status="FX_OK" sftp_request="SSH_FXP_OPEN") 
   OR (libssh2_error="LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED")
| stats count by src_ip, dest_ip, user, sftp_status, libssh2_error
| where count > 1
| sort - count
| table _time, src_ip, dest_ip, user, sftp_status, libssh2_error, count

Wazuh OSSEC Rule

<group name="libssh2,">
  <rule id="100403" level="12">
    <if_sid>100400</if_sid>
    <match>LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED</match>
    <regex>sftp_status.*FX_OK</regex>
    <description>CVE-2026-66032: Libssh2 SFTP double-free trigger detected — anomalous FX_OK response followed by channel packet errors.</description>
    <group>attack,execution,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

This Wazuh rule triggers on log entries that contain libssh2 error messages related to channel packet exceeded errors combined with SFTP status FX_OK responses — matching the exact exploitation pattern described in the NVD entry.

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — The fix is confirmed by NVD and OSV, two independent sources, via commit 5e47761.

Immediate Mitigations (Before Patching):

1. Disable SFTP where not required: If applications using libssh2 do not require SFTP functionality, disable it in configuration or through application-level guards.
2. Network segmentation: Restrict outbound SSH connections from critical systems to only trusted, verified SSH servers. Implement egress filtering to prevent connections to unknown or untrusted IP addresses.
3. Egress filtering and allowlists: Where possible, enforce allowlists of SSH servers that client applications may connect to.
4. Monitor for anomalous SFTP behavior: Deploy the detection rules above to identify potential exploitation attempts in progress.

Patch/Upgrade Steps:

1. Apply the upstream fix: Obtain the patched code by updating to a version of libssh2 that incorporates commit 5e47761, or apply this commit directly to source trees.
2. Rebuild dependent applications: Applications that statically link libssh2 must be recompiled with the patched library version.
3. For dynamically linked applications: Update the system libssh2 package and restart dependent services. On Debian/Ubuntu: sudo apt update && sudo apt install --only-upgrade libssh2-1. On RHEL/CentOS: sudo yum update libssh2.
4. Verify patched version: After updating, verify the installed version is > 1.11.1 by checking pkg-config --modversion libssh2 or the appropriate system package manager.
5. Container images and embedded systems: Rebuild any container images or embedded firmware that include libssh2 from source using the patched revision.

Long-Term Hardening:

1. Track libssh2 security advisories: Subscribe to the libssh2 mailing list and monitor the project's security page to stay aware of future vulnerability disclosures.
2. Implement credential hygiene: Ensure that service accounts connecting to SSH/SFTP have minimum required privileges.
3. Prefer newer, actively-maintained SFTP libraries: Evaluate whether newer forks or alternative libraries (e.g., libssh with better memory safety practices) are appropriate for critical applications.
4. Enable system call interpositioning (where feasible): Consider using tools like seccomp or AppArmor to limit the impact of successful exploitation of memory corruption vulnerabilities.
5. Memory hardening: Use heap-hardening techniques such as malloc perturbation (MALLOC_PERTURB_) during testing to expose double-free issues earlier in the development cycle.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-66032
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-66032
3. Libssh2 Official Repository: https://github.com/libssh2/libssh2
4. CWE-415 (Double Free) Reference: https://cwe.mitre.org/data/definitions/415.html
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-66032 is not currently listed in the CISA KEV catalog.

Threat Actor Campaign Notes: As of this writing, there are no known widespread exploitation campaigns specifically targeting CVE-2026-66032, and no public PoC exploits have been released. However, given the double-free/tcache-dup exploitation primitive that is well-documented in public security research, weaponization of this vulnerability is highly likely. Security teams should treat this as a high-priority vulnerability class and patch accordingly.