libssh2 Heap Out-of-Bounds Read via publickey subsystem

libssh2 versions through 1.11.1 contain a vulnerability in the publickey subsystem where the version 1 response parser in libssh2_publickey_list_fetch() reads a server-controlled comment_len value without verifying buffer length. This leads to an out-of-bounds heap read that leaks heap pointers and subsequent heap allocator corruption when an uninitialized pointer is freed during error cleanup. The issue is fixed in commit a13bb6c.

Exploitation of this vulnerability can lead to information disclosure by leaking heap pointers, which can defeat address space layout randomization (ASLR). Additionally, heap allocator state corruption may occur, potentially causing application crashes or enabling further exploitation. The CVSS 3.1 base score is 7.5, indicating a medium severity with high impact on confidentiality, integrity, and availability.

A fix for this vulnerability is available in libssh2 as of commit a13bb6c. Users should upgrade to a version including this fix to remediate the issue. No vendor advisory content was provided to indicate alternative mitigations or if the issue is already mitigated in specific distributions.