{"id":"CVE-2026-55200","title":"libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field","summary":"libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessiv…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-680"],"vendor":"libssh2","product":"libssh2","affected":["libssh2 = 1.11.1"],"published":"2026-06-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:04:42.983","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55200","references":[{"url":"https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8","label":"disclosure@vulncheck.com"},{"url":"https://github.com/libssh2/libssh2/pull/2052","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c","label":"disclosure@vulncheck.com"},{"url":"https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available"],"epss":0.04024,"epssPercentile":0.90144,"exploits":{"github":3,"githubRepos":["https://github.com/0xBlackash/CVE-2026-55200","https://github.com/xd20111/CVE-2026-55200","https://github.com/kaleth4/CVE-2026-55200"],"checkedAt":"2026-09-24T07:53:07.656Z"},"exploitAvailable":true,"ingestedAt":"2026-09-17T17:23:30.592Z","slug":"CVE-2026-55200","body":"## Overview\n\nlibssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.\n\n## Affected\n\n- `libssh2 = 1.11.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.8,"exploitation":12,"ransomware":0},"changes":[]}