CVE-2026-55200

HIGH POC Pub 17/06 Upd 22/10

Overview

This vulnerability is an out-of-bounds write caused by improper validation of the packet_length field within the ssh2_transport_read() function of libssh2 version 1.11.1. The root cause is a failure to enforce upper bounds on the packet_length value when processing incoming SSH packets. The affected component is the SSH transport layer packet parsing mechanism, which handles incoming SSH protocol messages.

Vulnerability Description

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Impact

An unauthenticated remote attacker can exploit this flaw by sending specially crafted SSH packets to corrupt heap memory, resulting in arbitrary remote code execution within the context of the libssh2 client or server. This enables full system compromise, including execution of malicious code or commands. No user interaction or credentials are required, making it a critical risk for services relying on vulnerable libssh2 versions for SSH communications.

Solution

Upgrade libssh2 to a version including the fix from commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 or later. The vulnerability is resolved starting with versions post-1.11.1. Refer to the official libssh2 GitHub repository pull request #2052 and commit 97acf3d for patch details. No vendor advisory ID is provided; follow the libssh2 project repository for patch application instructions and verify version updates to mitigate this issue.

EPSS vs KEV Prediction — Evolution (30 days)

Affected Products (1)

Vendor Product Version CPE
libssh2 Libssh2 Libssh2 1.11.1 cpe:2.3:a:libssh2:libssh2:1.11.1:*:*:*:*:*:*:*
Warning: The exploits and proof-of-concept (PoC) code listed below are sourced from third-party public repositories. CSURFACE assumes no responsibility for the content, accuracy, or safety of these resources. Use at your own risk. Learn more

GitHub PoCs (3)

Repository Author Stars Forks Date Link
0xBlackash/CVE-2026-55200
CVE-2026-55200
 0xBlackash 10 2 2026-06-23 View
xd20111/CVE-2026-55200
CVE-2026-55200 - Critical libssh2 Remote Code Execution Vulnerability
 xd20111 4 1 2026-06-29 View
kaleth4/CVE-2026-55200
 kaleth4 0 0 2026-07-02 View
Exploited in Wild NOT DETECTED
Ransomware NOT ASSOCIATED
Attacker Interest HIGH
Sightings Considerable activity

Threat Feed

2 events
2026-10-03
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-06-23
PoC Published (3 GitHub repositories)

Proof-of-concept code is publicly available for this vulnerability

Likely Kill Chain

Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.

Applicable Out of scope
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040

Highlighted stages are those attackers typically reach when exploiting this CVE. Heuristic based on CWE families — refined by ML classifier when available.

Attack Vectors ML

Classification Pending

This CVE has not yet been processed by the ML classifier. Will be classified in the next daily run.

MITRE ATT&CK Techniques (0)

ATT&CK techniques pending

Techniques are derived from this CVE's kill chains once ML classification completes.

CAPEC Attack Patterns

No CAPEC pattern mapped to this CVE.

Red Team Playbook

AtomicRedTeam integration in progress

Executable commands will be auto-mapped to each ATT&CK technique of this CVE.

Detection & Response Rules

No detection or response rules found for this CVE.

No news articles or mentions found for this CVE.

References (5)

Title Tags URL
nvd.nist.gov
NVD reference
https://nvd.nist.gov/vuln/detail/CVE-2026-55200
github.com
GitHub CVE issue-tracking
https://github.com/libssh2/libssh2/pull/2052
github.com
GitHub CVE patch
https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
vulncheck.com
GitHub CVE third-party-advisory
https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c
web.archive.org
NVD API Exploit Third Party Advisory
https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc