CVE-2026-55200: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

Synopsis

An out-of-bounds write vulnerability exists in libssh2 through version 1.11.1, located in the ssh2_transport_read() function in transport.c. The function fails to enforce an upper bound on the packet_length field, allowing a remote, unauthenticated attacker to send a crafted SSH packet over the network. Successful exploitation corrupts heap memory and enables remote code execution on the affected host. A patched-image rebuild at fix commit 7acf3dfda80c91c3a8c9f2372546301d4a1a7a8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target's SSH service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or credential is required; the vulnerable code path is exercised during unauthenticated packet parsing.

• Victim interactionNot required

  No user action is needed; the attacker drives the exploit entirely by sending crafted SSH packets.

• Attack complexityDetail

  Base exploit conditions are low-complexity, though the CVSS AT:P token indicates that specific target configuration factors (such as heap layout) must align, making fully reliable exploitation dependent on environmental conditions.

Blast Radius

• Attacker achieves remote code execution on the host running the vulnerable libssh2 instance.
• Heap memory corruption grants read and write access to process memory, exposing in-memory secrets such as private keys, session credentials, and decrypted SSH payloads.
• Attacker can modify in-memory state of the affected process, potentially pivoting to persistent access or lateral movement within the container or host network.
• The affected service process crashes if exploitation is not fully successful, disrupting SSH-dependent workflows and any application relying on libssh2 for connectivity.