CVE-2026-55200
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 4.02%
- CWE
- CWE-680
- Published
- 2026-06-17
- Last modified
- 2026-07-14
Affected products
- libssh2 libssh2
- libssh2 libssh2
Weakness type
Related vulnerabilities
- CVE-2026-81647 — Out-of-bounds read vulnerability in the graphics module....
- CVE-2026-19313 — Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution
- CVE-2026-70651 — libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick
- CVE-2026-19588 — Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow...
- CVE-2026-43627 — llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function
- CVE-2026-8376 — Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
- CVE-2026-24928 — Out-of-bounds write vulnerability in the file system module....
- CVE-2026-25541 — Bytes is vulnerable to integer overflow in BytesMut::reserve