Libssh2 vulnerability before 1.11.1 - CVE-2026-55200

Vulnerabilities
,
1

CVSSv3: 8.1

CVSSv4: 9.2

Looks like this one has patches available, but they may not be pushed out to all distros.

libssh2 is used by curl but NOT OpenSSH as far as I can tell.

It’s an out-of-bounds write vulnerability that allows clients to write past the end of the buffer and corrupt memory. No authentication is required. If they corrupt heap memory in the right way, it may lead to remote code execution.

I haven’t seen any chatter about anyone exploiting it yet, anyone else?

https://cybernews.com/security/libssh2-critical-vulnerability-enables-rce/

2 Likes
2

There appears to be a public exploit at GitHub - 0xBlackash/CVE-2026-55200: CVE-2026-55200 · GitHub . I have not yet confirmed it but it sure looks good.

1 Like
3

Adding this care of Will Dormann.

1 Like
4

Repo is down but it’s archived: exploitarium/libssh2-cve-2026-55200-poc at main · bikini/exploitarium · GitHub

1 Like
5

Additional write-up from Arctic Wolf. Critical Remote Code Execution Vulnerability in libssh2 Client Library Require Urgent Mitigation - Arctic Wolf