SB2026022406 - Multiple vulnerabilities in libssh

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026022406

SB2026022406 - Multiple vulnerabilities in libssh

Published: February 24, 2026 Updated: July 27, 2026

Security Bulletin ID SB2026022406
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-0968)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the sftp_parse_longname() function. A malicious SFTP server can send a specially crafted SSH_FXP_NAME message to trigger an out-of-bounds read and crash the application or read parts of system memory on the client system. 


2) Input validation error (CVE-ID: CVE-2026-0967)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the match_pattern() function when comparing configuration files or known hosts against the hostname. A local user with ability to modify the configuration file or known_hosts file can crash the application. 


3) Buffer underflow (CVE-ID: CVE-2026-0966)

CWE-ID: CWE-124 - Buffer Underwrite ('Buffer Underflow')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error within the ssh_get_hexa() function when reading zero-length input during GSSAPI authentication. A remote attacker can send specially crafted data to the application and perform a denial of service attack. 


4) Input validation error (CVE-ID: CVE-2026-0965)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to crash the application.

The vulnerability exists due to insufficient validation of user-supplied input when parsing configuration filers. A local user can supply a specially crafted configuration and crash the application.


5) Path traversal (CVE-ID: CVE-2026-0964)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick the victim into connecting to a malicious SCP server and overwrite arbitrary files on the user's system. 


6) Improper access control (CVE-ID: CVE-2025-14821)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to manipulate trusted SSH configuration and host key data to compromise connection security.

The vulnerability exists due to improper access control in the global configuration file loading behavior on Windows when loading configuration files and ssh_known_hosts from the C:\etc directory. A local user can create attacker-controlled files in that directory to manipulate trusted SSH configuration and host key data to compromise connection security.

This issue occurs when libssh is built with default configure options on Windows.


Remediation

Install update from vendor's website.

References