Critical Remote Code Execution Vulnerability in libssh2

Successful exploitation could allow unauthenticated attackers to achieve remote code execution via crafted SSH packets

Threat ID:: CC-4799
Threat Severity:: Medium
Published:: 23 June 2026 2:17 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation could allow unauthenticated attackers to achieve remote code execution via crafted SSH packets

Affected platforms

The following platforms are known to be affected:

libssh2

All prior to commit 7acf3df

Threat details

Introduction

The libssh2 project has released security updates to address a critical vulnerability in libssh2. Remote unauthenticated attackers could send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution (RCE).

CVE-2026-55200 - 'Integer Overflow to Buffer Overflow' vulnerability - CVSSv4 Base Score: 9.2

Remediation advice

Affected organisations are encouraged to review libssh2 advisory GHSA-R8MH-X5QV-7GG2 and apply the relevant update as soon as possible.

Definitive source of threat updates

https://github.com/advisories/GHSA-R8MH-X5QV-7GG2

CVE Vulnerabilities

Status Published

CVE-2026-55200

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Last edited: 23 June 2026 2:17 pm