libssh2 publickey-subsystem attribute-count integer overflow leading to heap buffer overflow in client

libssh2 ≤ 1.11.1 calls libssh2_publickey_list_fetch() to enumerate keys from a server's publickey subsystem. The parser reads an attacker-controlled 32-bit num_attrs from the wire and computes num_attrs * sizeof(libssh2_publickey_attribute) to size an allocation — with no overflow check. On 32-bit builds, num_attrs = 0x0ccccccd wraps the multiplication to 4 bytes, after which the attribute-parsing loop happily writes past the tiny heap chunk. The public PoC (bikini/exploitarium) demonstrates calc.exe execution on Win32 and a separate free/double-free chain on Win64 via a malformed version response. The bug lives in src/publickey.c; everything that links libssh2 — curl, git, libcurl-based agents, OpenWrt droplets, embedded clients — inherits it.

Vendor HIGH (7.0) is *defensible but optimistic*. The CVSS vector encodes the reality: AV:N/AC:H/PR:N/UI:N, meaning network reachable but high complexity because you have to either coerce a victim to connect to your malicious SSH server or MITM an existing connection. The integrity/confidentiality impact is :L only because the primary outcome is corrupted client memory; availability is :H because you can absolutely crash the client. The real-world ceiling depends on whether the libssh2 build is 32-bit — increasingly rare on servers, still common on embedded routers/IoT and some Windows installer toolchains. For a 64-bit Linux fleet running git-over-ssh against trusted forges, this is a backlog item, not a fire.

Sources.

1. VulnCheck advisory — libssh2 publickey integer overflow
2. NVD — CVE-2026-58050
3. PoC repo — bikini/exploitarium libssh2 publickey-list calc PoC
4. RedPacket Security — CVE alert
5. CIRCL Vulnerability-Lookup — CVE-2026-58050
6. GHSA-mf77-5hj2-98w9 (libssh2 advisory mirror)
7. RFC 4819 — SSH Public Key Subsystem
8. libssh2 upstream — src/publickey.c

Run on each Linux/macOS target host as any user (no privileges required). Invoke as ./check_cve_2026_58050.sh. The script locates the libssh2 shared library, extracts its version string, checks whether the host is 32-bit, and reports VULNERABLE / PATCHED / UNKNOWN. For Windows targets, port the logic against libssh2.dll version metadata.

#!/usr/bin/env bash
# check_cve_2026_58050.sh — libssh2 publickey-subsystem integer overflow
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

FIXED_MAJOR=1
FIXED_MINOR=11
FIXED_PATCH=2   # first release expected to carry the fix; adjust when upstream tags

find_lib() {
  for p in /usr/lib /usr/lib64 /usr/local/lib /lib /lib64 /opt; do
    find "$p" -maxdepth 4 -name 'libssh2.so*' 2>/dev/null
  done | sort -u
}

ver_from_lib() {
  local lib="$1"
  # libssh2 embeds version via LIBSSH2_VERSION macro -> strings grep
  strings "$lib" 2>/dev/null | grep -Eo '^libssh2/[0-9]+\.[0-9]+\.[0-9]+' | head -1 | cut -d/ -f2
}

is_32bit() {
  local lib="$1"
  file "$lib" 2>/dev/null | grep -q 'ELF 32-bit'
}

verdict=UNKNOWN
found=0
while IFS= read -r lib; do
  [ -z "$lib" ] && continue
  found=1
  ver=$(ver_from_lib "$lib")
  arch32=no; is_32bit "$lib" && arch32=yes
  if [ -z "$ver" ]; then
    echo "[?] $lib — version string not found (arch32=$arch32)"
    [ "$verdict" = UNKNOWN ] && verdict=UNKNOWN
    continue
  fi
  IFS=. read -r MA MI PA <<<"$ver"
  if [ "$MA" -gt "$FIXED_MAJOR" ] || \
     { [ "$MA" -eq "$FIXED_MAJOR" ] && [ "$MI" -gt "$FIXED_MINOR" ]; } || \
     { [ "$MA" -eq "$FIXED_MAJOR" ] && [ "$MI" -eq "$FIXED_MINOR" ] && [ "$PA" -ge "$FIXED_PATCH" ]; }; then
    echo "[+] $lib v$ver (arch32=$arch32) PATCHED"
    [ "$verdict" != VULNERABLE ] && verdict=PATCHED
  else
    echo "[!] $lib v$ver (arch32=$arch32) VULNERABLE — primary RCE primitive applies on 32-bit"
    verdict=VULNERABLE
  fi
done < <(find_lib)

if [ "$found" -eq 0 ]; then
  echo "[?] libssh2 not found in standard paths — check statically linked binaries (curl, git, etc.)"
  echo UNKNOWN
  exit 2
fi

echo "$verdict"
case "$verdict" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac