The vulnerability CVE-2026-7598 affects the libssh2 library used in Red Hat Hardened Images RPMs. It is an integer overflow in the userauth_password function where manipulated username_len or password_len arguments cause a heap-based buffer overflow. This can crash the application linked to libssh2 and potentially allow arbitrary code execution. Exploitation requires supplying large values to these arguments, typically in applications processing untrusted SSH authentication requests. Red Hat notes that default security mechanisms such as SELinux, ASLR, and NX stack protection reduce the likelihood of successful arbitrary code execution. The vulnerability is associated with CWE-190 (Integer Overflow or Wraparound).

The primary impact is a denial of service due to application crash from memory corruption. There is also a potential for arbitrary code execution if the attacker can successfully exploit the overflow despite default security mitigations. The vulnerability affects integrity and availability of the affected applications. No known exploits in the wild have been reported. The severity is assessed as high by Red Hat, with a CVSS base score of 9.1 by Red Hat's internal scoring.

Red Hat recommends mitigating this vulnerability by configuring or updating applications linked to libssh2 to disable password-based authentication and use public key authentication exclusively. This prevents execution of the vulnerable userauth_password function. No official patch or fix is explicitly stated in the advisory; therefore, patch status is not yet confirmed. Users should monitor Red Hat advisories for updates and apply them once available.