Logo
›
›vulnerability›CVE-2026-58050
Name
CVE-2026-58050
Source
NVD ( link)Debian ( link)
Description
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.
CWEs
CWE-190
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-pocBroken Link
https://github.com/libssh2/libssh2/blob/master/src/publickey.cProduct
https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocationThird Party Advisory

Analysis#

Affected Component
Analysis
libssh2
Exploitable

Vulnerability Ratings#

8.3
CVSSv4
7
CVSSv31
7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
libssh2
buildroot
2025.02.x
1.11.1
Exploitable
libssh2
openwrt
master
1.11.1-r1
Exploitable
libssh2
openwrt
openwrt-25.12
1.11.1-r1
Exploitable
libssh2
yocto
kirkstone
1.10.0
Exploitable
libssh2
yocto
master
1.11.1
Patched
libssh2
yocto
scarthgap
1.11.1
Exploitable

Resolved with patches#

libssh2 (yocto:master)

#
Title
Author
Resolve
1
publickey: fix potential multiplication overflow in 32-bit
Viktor Szakats <commit@vsz.me>
CVE-2026-58050