CVE-2026-55200: libssh2 Out-of-Bounds Write Remote Code Execution Vulnerability

Technical summary

CVE-2026-55200 is an out-of-bounds write vulnerability in the ssh2_transport_read() function of libssh2 through version 1.11.1. The flaw stems from insufficient bounds checking on the packet_length field within SSH protocol packet headers. Attackers can craft SSH packets with abnormally large packet_length values that exceed allocated heap buffer sizes. During packet processing, this causes data to be written past buffer boundaries, corrupting heap metadata and adjacent objects. The vulnerability is classified under CWE-680 (Integer Overflow to Buffer Overflow). A fix is available in commit 7acf3df and should be incorporated in future releases; verify against the vendor advisory for the specific patched version number.

Business impact

This vulnerability poses significant operational risk to organizations relying on libssh2 for SSH protocol support. Compromised systems can suffer complete loss of confidentiality, integrity, and availability. Affected infrastructure ranges from embedded SSH clients in applications to server-side SSH services. Remote code execution via an unauthenticated network vector enables adversaries to establish persistent footholds, steal sensitive data, deploy malware, or disrupt critical operations without requiring valid credentials or user interaction.

Affected systems

Any system or application using libssh2 library versions through 1.11.1 is potentially affected. This includes SSH client applications, embedded systems with SSH capabilities, and services that depend on libssh2 for SSH protocol implementation. The vulnerability does not require local access or special privileges to trigger, making any exposed SSH service a potential attack surface.

Exploitability

The vulnerability is highly exploitable. An attacker needs only network connectivity to the target system and no authentication credentials. The attack is triggered by sending a specially crafted SSH packet, requiring moderate complexity to craft but executable over standard network infrastructure. The CVSS 3.1 score of 8.1 reflects the combination of remote attackability (AV:N), high impact on all confidentiality, integrity, and availability dimensions, and the practical feasibility of exploitation.

Remediation

Organizations should immediately identify all systems and applications using libssh2 and assess their version numbers. Update to a patched version once available from the libssh2 project—verify against the official vendor advisory for the exact version that incorporates the fix from commit 7acf3df. For systems that cannot be updated immediately, consider network-level mitigations such as restricting SSH access to trusted sources via firewall rules or VPNs. Disable SSH services that are not actively needed.

Patch guidance

Monitor the libssh2 project repositories and official release channels for version updates addressing this vulnerability. The fix is identified in commit 7acf3df; check the vendor's release notes to determine which released version incorporates this commit. Once a patched version is available, prioritize deployment to production systems and applications, starting with internet-facing or high-value assets. Test patches in non-production environments before broad rollout to ensure compatibility with dependent applications.

Detection guidance

Network-based detection is challenging because the attack involves a single malformed packet that may not trigger typical IDS signatures. Endpoint detection should focus on libssh2 process behavior anomalies—unexpected child process spawning, privilege escalation attempts, or abnormal system calls following SSH connection establishment. Log analysis should examine SSH server logs for connection attempts from unusual sources or unexpected disconnections. Vulnerability scanning tools can identify libssh2 versions in use; correlate version information with the affected range (through 1.11.1) to locate unpatched deployments.

Why prioritize this

This vulnerability merits urgent priority due to the combination of remote exploitability without authentication, high impact (complete system compromise via RCE), broad applicability across multiple deployment scenarios, and moderate complexity of exploitation. Although not yet in the KEV catalog, the technical characteristics align with actively exploited vulnerability patterns. Organizations should treat this as critical and expedite patching cycles accordingly.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network-accessible attack vector (AV:N)—no local access required; (2) High complexity (AC:H)—the attacker must craft specific malformed packets, but this is achievable; (3) No privileges or user interaction needed (PR:N, UI:N); (4) Unchanged scope (S:U); and (5) High impact across confidentiality, integrity, and availability (C:H, I:H, A:H)—successful exploitation enables arbitrary code execution with full system compromise. The score appropriately elevates this above moderate-severity flaws due to the remote RCE potential.

Frequently asked questions