A double-free heap corruption vulnerability exists in libssh2 versions prior to 1.11.1_4 in the sftp_open() function. This flaw allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session by triggering a double free of a response data buffer under specific error conditions. The issue is fixed in version 1.11.1_4.