CVE-2026-55200CWE-680

CVE-2026-55200

High · published June 18, 2026

CVSS v3.1
8.1
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04024 · 90.5th percentile
Weakness
CWE-680 · Integer Overflow to Buffer Overflow
Published
2026-06-18T00:17Z
Affected products (1)
ProductVersionsFixed in
libssh2/libssh2all versions—
References (4)
https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 · [email protected]https://github.com/libssh2/libssh2/pull/2052 · [email protected]https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c · [email protected]https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 JUN 19:03Z
    libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
    cvelistv5