ANT-2026-Q5A1RHS0 · libssh2/libssh2

double-free high

CVE-2026-66032

Severity Claude critical · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif.

ANT-2026-Q5A1RHS0: SFTP double-free via server-controlled FXP_STATUS packet length

The SFTP client's handler for SSH_FXP_STATUS messages allocates a buffer whose size is taken directly from a server-supplied packet length field. With a crafted response, this buffer ends up being released twice along the client code path. Because the server controls both the allocation size and the sequencing that leads to the two frees, a malicious or compromised SSH server can reliably induce a double-free in any connecting client. This corrupts heap allocator state and may be leveraged for remote code execution on the client.

Target

Project: libssh2/libssh2
Location: SFTP packet handling (libssh2 client)

Technical Details

Malicious SSH server sends crafted SSH_FXP_STATUS where packet length controls allocation that is freed twice in SFTP client path. Allocation size and free sequencing server-controlled.

Reproduction

  1. Attacker operates or compromises an SSH server the victim will connect to
  2. Victim starts an SFTP session against that server
  3. Server responds with a crafted SSH_FXP_STATUS packet containing a chosen length field
  4. Client allocates a buffer of attacker-chosen size and subsequently frees it twice

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Suggested Fix

NULL the pointer after first free; restructure SFTP error path to not re-enter cleanup.

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-Q5A1RHS0.

Reference: ANT-2026-Q5A1RHS0
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Calif.

Verdict
true positive
Severity
high
UPSTREAM FIX

The change that resolved this finding.

diff --git a/src/sftp.c b/src/sftp.c
index ec3a8ae18a..842eb6ea51 100644
--- a/src/sftp.c
+++ b/src/sftp.c
@@ -1259,6 +1259,7 @@ static LIBSSH2_SFTP_HANDLE *sftp_open(LIBSSH2_SFTP *sftp,
                 ssh2_deb((session, LIBSSH2_TRACE_SFTP, "got HANDLE FXOK"));
 
                 SSH2_FREE(session, data);
+                data = NULL;
 
                 /* silly situation, but check for a HANDLE */
                 rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,

https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0

TIMELINE

Dates from discovery through public reveal.

  1. 2026-04-10 Reported to tracker
  2. 2026-05-08 Sent to maintainer
  3. 2026-05-09 Maintainer acknowledged
  4. 2026-07-01 Patch released
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

c95720be6ce18be43e5a114a6d86a7d4aefcf6c4c1fe181d1ce94f81ed83af02e425f520c6a995a091d6341a318d3af8813d5863c169cdcc22353bc11912122c

Committed 2026-05-08 00:10 PT

Revealed 2026-08-17 10:47 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-Q5A1RHS0",
  "bug_class": "double_free",
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-04-11T01:14:19+00:00",
  "description": "The SFTP client's handler for SSH_FXP_STATUS messages allocates a buffer whose size is taken directly from a server-supplied packet length field. With a crafted response, this buffer ends up being released twice along the client code path. Because the server controls both the allocation size and the sequencing that leads to the two frees, a malicious or compromised SSH server can reliably induce a double-free in any connecting client. This corrupts heap allocator state and may be leveraged for remote code execution on the client.",
  "discovered_at": null,
  "location": "SFTP packet handling (libssh2 client)",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "libssh2/libssh2",
  "reproduction": [
    "1. Attacker operates or compromises an SSH server the victim will connect to",
    "2. Victim starts an SFTP session against that server",
    "3. Server responds with a crafted SSH_FXP_STATUS packet containing a chosen length field",
    "4. Client allocates a buffer of attacker-chosen size and subsequently frees it twice"
  ],
  "technical_details": "Malicious SSH server sends crafted SSH_FXP_STATUS where packet length controls allocation that is freed twice in SFTP client path. Allocation size and free sequencing server-controlled.",
  "title": "SFTP double-free via server-controlled FXP_STATUS packet length",
  "vendor_severity": "high"
}