CVE-2026-55200 in libssh2<br>Recent

Updates

Archive

Submits

Vendor

Product

Type

LoginSignup<br>CVE-2026-55200 in libssh2info<br>Summary<br>by MITRE &bull; 06/17/2026<br>libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.<br>Analysis<br>by VulDB Data Team &bull; 06/18/2026<br>The vulnerability in libssh2 versions through 1.11.1 represents a critical out-of-bounds write condition that exists within the ssh2_transport_read() function, specifically failing to validate the upper bounds of the packet_length field in SSH protocol packets. This flaw stems from inadequate input sanitization where the library does not properly constrain the size parameter that dictates how much data should be read from incoming SSH packets. The vulnerability is categorized under CWE-787 Out-of-bounds Write, which is a well-known weakness pattern that allows attackers to write data beyond the allocated memory boundaries. When remote attackers craft malicious SSH packets containing excessively large packet_length values, they can manipulate the memory layout of the affected application, leading to heap corruption that can be exploited for arbitrary code execution. The flaw operates at the transport layer of the SSH protocol implementation, making it particularly dangerous as it can be triggered during the initial connection establishment phase when the library processes incoming packets from untrusted sources.

The operational impact of this vulnerability extends beyond simple memory corruption, as it provides attackers with a pathway to achieve remote code execution on systems running vulnerable versions of libssh2. The out-of-bounds write condition creates opportunities for attackers to overwrite critical memory structures, function pointers, or return addresses, potentially allowing them to redirect program execution flow. This vulnerability is particularly concerning in environments where libssh2 is used as a library component in server applications, network services, or embedded systems that handle SSH connections from untrusted clients. The exploitability of this flaw is enhanced by the fact that it requires no authentication to trigger, as the vulnerability is present in the packet parsing logic that handles all incoming SSH traffic regardless of authentication status. Attackers can leverage this vulnerability to gain unauthorized access to systems, escalate privileges, or establish persistent backdoors within network infrastructure that relies on libssh2 for secure communications.

Mitigation strategies for this vulnerability must address both immediate remediation and long-term architectural improvements to prevent similar issues in the future. The primary solution involves upgrading to libssh2 version 1.12.0 or later, where the commit 7acf3df includes proper bounds checking for the packet_length field that prevents the out-of-bounds write condition. Organizations should implement comprehensive patch management procedures to ensure all systems using libssh2 are updated promptly, particularly in environments where the library is embedded within larger applications or services. Additional defensive measures include implementing network-level protections such as firewall rules that restrict SSH access to trusted sources, deploying intrusion detection systems that can identify malformed SSH packets, and conducting regular security assessments of applications that utilize libssh2 to identify potential exploitation vectors. The vulnerability also highlights the importance of following secure coding practices and adhering to the principle of least privilege in network protocol implementations, as demonstrated by the ATT&CK technique T1059.007 Command and Scripting Interpreter: Unix Shell, where improper input validation can lead to arbitrary code execution. Organizations should also consider implementing memory protection mechanisms such as stack canaries, address space layout randomization, and data execution prevention to limit the impact of potential exploitation attempts even if the primary vulnerability is not patched.

 Show More Details<br>An in-depth analysis is available in our curated vulnerability entry.

Responsible<br>VulnCheck

Reservation<br>06/16/2026

Disclosure<br>06/17/2026

Moderation<br>accepted

Entry<br>VDB-372111

CPE<br>ready

CWE<br>CWE-680 (confirmed)

CVSS<br>8.1 (CNA)

EPSS<br>0.00000

KEV<br>no

Activities<br>high

Sources<br>MITREhttps://www.cve.org/CVERecord?id=CVE-2026-55200NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-55200CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-55200/<br>◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?<br>Upgrade your account now!

Extended CVE DB<br>The Extended CVE DB collects official CVE entries and enriches them with additional datapoints...