A double-free vulnerability in the libssh2 library can lead to heap corruption and potential remote code execution when processing malicious SFTP requests.

The vulnerability is a double-free (CWE-415) triggered within the SFTP open processing logic, which can result in heap corruption and potentially arbitrary code execution when the library processes a specifically crafted packet.

Because libssh2 is a fundamental component in many networking tools and applications, this vulnerability has a broad potential impact. With a CVSS score of 8.8, successful exploitation could allow a remote attacker to compromise systems utilizing the library, leading to unauthorized access, data theft, or service disruption.

Immediate Action: Update the libssh2 library to the version containing the fix commit 5e4776146552d898b9c0e1b313cd093fa8dc92d0 or higher.

Proactive Monitoring: Monitor network traffic for anomalous SSH or SFTP requests that deviate from standard operational patterns.

Compensating Controls: Utilize network-level intrusion detection systems to identify and block malformed packets that might target known heap corruption patterns in SSH implementations.

Public Exploit Available: No

This is a critical library-level vulnerability that requires immediate attention from any organization maintaining software that links against libssh2. Development and operations teams must prioritize rebuilding their applications with the patched version of the library to eliminate this risk.