CVE-2026-66035 is a pre-authentication heap buffer overflow vulnerability in libssh2. During the Encrypt-then-MAC (ETM) cipher negotiation phase of an SSH connection, a malicious SSH server can send a specially crafted packet that corrupts heap memory on the client. This corruption can potentially lead to arbitrary code execution on the connecting client before authentication completes. The vulnerability affects libssh2 packages included in Red Hat Hardened Images RPMs, specifically version 1.11.1-10.3.hum1. Exploitation requires the client to initiate a connection to a compromised or malicious SSH server, which limits the attack vector. The vulnerability is classified under CWE-120 (Classic Buffer Overflow). Red Hat has published advisories detailing the issue but has not yet released a patch for the affected packages.

Successful exploitation allows a malicious SSH server to execute arbitrary code on the client machine before authentication, potentially compromising client integrity and availability. The attack requires no privileges and no user interaction beyond initiating the SSH connection. The impact includes possible denial of service due to crashes and unauthorized code execution. However, the attack surface is limited because the client must connect to a malicious or compromised server.

Red Hat recommends restricting SSH client connections to trusted and verified SSH servers to reduce exposure. Avoid connecting to unknown or untrusted SSH servers, as exploitation requires a client connection to a malicious server. No official patch or fix is currently available for the affected Red Hat Hardened Images RPMs. Monitor Red Hat advisories for updates and apply patches once released.