0xBlackash/CVE-2026-55200

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A C server that performs a partial SSH handshake and sends a crafted packet with an oversized packet_length field (0xFFFFFFFF) to trigger an out-of-bounds write in vulnerable libssh2 clients.

Backdoor review

No backdoor observed in reviewed code

The PoC code in CVE-2026-55200.c implements a malicious SSH server that sends a crafted packet with an oversized packet_length field to trigger the described CVE-2026-55200 vulnerability in a vulnerable libssh2 client. The code performs a standard SSH handshake (banner exchange, KEXINIT) and then sends the malicious packet. No backdoor, deceptive payload, or concealed operator-directed harm (such as credential theft, persistence, or unrelated remote access) is present. The README.md is a documentation file describing the vulnerability and does not contain executable instructions or hidden payloads.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC
Target softwarelibssh2
Attack typesOut-of-Bounds WriteHeap CorruptionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The C code actively constructs and sends a malicious network packet designed to exploit a specific vulnerability (CVE-2026-55200) in a target client. It performs a handshake and then delivers the payload, which is the definition of an exploit.

CVE-2026-55200.c:2-3CVE-2026-55200.c:50-59CVE-2026-55200.c:62

Requirements

  • A client using a vulnerable version of libssh2 (<= 1.11.1) must connect to the attacker's server.CVE-2026-55200.c:62

Observed behavior

  • Listens on a TCP port and accepts client connections.CVE-2026-55200.c:77-97
  • Sends an SSH banner and a fake SSH_MSG_KEXINIT to initiate a handshake.CVE-2026-55200.c:29-41
  • Constructs and sends a malicious SSH packet with a packet_length of 0xFFFFFFFF and a payload of 700 'A' bytes.CVE-2026-55200.c:50-59
  • The malicious packet is intended to trigger an out-of-bounds write in the client's libssh2 ssh2_transport_read() function.CVE-2026-55200.c:2-3CVE-2026-55200.c:62
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Malicious Ssh Server
The PoC acts as a malicious SSH server listening on a configurable port (default 2222) and sends a crafted packet with packet_length set to 0xFFFFFFFF to trigger an out-of-bounds write in a vulnerable libssh2 client.This is the expected behavior of a PoC for CVE-2026-55200, which exploits an integer overflow to buffer overflow in libssh2's ssh2_transport_read(). The server does not establish a backdoor or perform any action beyond triggering the vulnerability.CVE-2026-55200.c:18CVE-2026-55200.c:49-59
Review boundaries

What the analysis did not establish

  • The evidence does not include the vulnerable libssh2 library source code or a vulnerable client binary, so the exploit's effectiveness cannot be verified from the provided files alone.
  • The README.md file contains images and references to external resources that are not included in the evidence.
  • Review is limited to the two text files provided (CVE-2026-55200.c and README.md). No other files exist in the repository snapshot. No binary analysis was performed, but none was required as the artifact contains only readable source code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1