An out-of-bounds write vulnerability exists in libssh2 versions prior to 1.11.1_3 in the ssh2_transport_read() function due to lack of upper bounds enforcement on the packet_length field. This flaw allows remote attackers to send specially crafted SSH packets with excessively large packet_length values, leading to heap memory corruption and potential remote code execution. The issue is fixed in libssh2 version 1.11.1_3.