A heap-based buffer overflow vulnerability in libssh2 version 1.11.1 and earlier poses a significant risk of remote code execution or system instability.

This is a heap-based buffer overflow (CWE-122) triggered during the negotiation of ETM ciphers. The vulnerability is exploitable by unauthenticated remote attackers who can influence the negotiation process, though it requires user interaction or specific environmental conditions to trigger.

Successful exploitation of this buffer overflow could allow an attacker to crash critical services relying on libssh2 or execute arbitrary code with the privileges of the application. Given the CVSS score of 7.5, this high-severity flaw represents a substantial risk to service availability and system integrity, potentially leading to unauthorized system control.

Immediate Action: Upgrade to the version containing the upstream fix identified by commit 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4.

Proactive Monitoring: Monitor system logs for unusual crash reports or unexpected process terminations associated with SSH client or server activities.

Compensating Controls: Ensure that network traffic involving SSH is restricted to trusted sources and consider implementing egress filtering to prevent potential callback attempts by malicious payloads.

Public Exploit Available: Unknown

The severity of this heap-based buffer overflow necessitates prompt attention from development and security teams. Organizations should prioritize updating all integrated instances of libssh2 to the patched version to eliminate the risk of remote memory corruption.