Critical Remote Code Execution Flaw in libssh2 Exploited via SSH Packets

Summary

The security community faces a critical vulnerability in libssh2, identified as CVE-2026-55200, which has been actively exploited. The issue stems from insufficient bounds checking on the packet_length field within the ssh2_transport_read() function. Attackers can exploit this by sending oversized SSH packets, leading to heap memory corruption and remote code execution. This vulnerability affects libssh2 versions up to 1.11.1, with a fix available in commit 7acf3df.

What Happened

The vulnerability was discovered due to an out-of-bounds write caused by unchecked packet_length values in the libssh2 library's SSH packet processing function. This oversight allows attackers to craft packets that exceed memory boundaries, corrupting heap memory and potentially executing arbitrary code on affected systems. The issue has been publicly disclosed with a proof of concept available, highlighting the urgency for organizations using vulnerable versions.

Technical Details

The core of the vulnerability lies in the ssh2_transport_read() function within libssh2's transport.c file. Specifically, the lack of bounds checking on the packet_length field allows attackers to specify excessively large values. The code snippet below illustrates the problematic logic:

if (p->packet_length < 1)
{
    return LIBSSH2_ERROR_DECRYPT;
}
else if (p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
    return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
}

This vulnerability was addressed in commit 7acf3df, which introduced additional checks to prevent out-of-bounds writes.

Affected Products and Fixed Versions

The affected product is the libssh2 library. All versions up to and including 1.11.1 are vulnerable. The fix has been implemented starting from commit 7acf3df onwards. Users of the library should update to at least this version or later to mitigate the risk.

Exploitation Status

CVE-2026-55200 is classified as CRITICAL with a CVSS score of 9.2, indicating that it is actively exploited in the wild. The public disclosure of a proof-of-concept exploit underscores the immediate threat posed by this vulnerability.

Indicators of Compromise

Indicators of compromise (IoCs) for this vulnerability are not explicitly detailed in the sources provided. However, organizations should monitor for unusual SSH traffic patterns and unexpected system behavior that could indicate exploitation attempts.

Detection Opportunities

Organizations can detect potential exploitation attempts by monitoring for anomalies in SSH packet sizes and frequencies. Implementing network intrusion detection systems (NIDS) with rules targeting oversized SSH packets may also help identify suspicious activities related to this vulnerability.

What Remains Unclear

While the technical details of the vulnerability are well-documented, specific IoCs that could aid in early detection have not been provided. Additionally, information on known exploitation attempts beyond the public proof-of-concept is limited.

Defender Guidance

Defenders should immediately update libssh2 to version 1.11.1 or later to mitigate this critical vulnerability. In addition to patching, organizations are advised to:

• Monitor network traffic for anomalies related to SSH communications.
• Implement strict access controls and monitoring on systems exposed to the internet.
• Review and update incident response plans to include scenarios involving remote code execution vulnerabilities.

By taking these steps, defenders can significantly reduce their exposure to this critical vulnerability and enhance their overall security posture against similar threats.