How to Use Exploitarium for libssh2 CVE‑2026‑55200: A Step‑by‑Step Exploitation Guide

Exploitarium provides a complete, self‑contained proof‑of‑concept (PoC) that demonstrates and exploits an integer‑wrap vulnerability in libssh2's ssh2_transport_read() function, enabling local RCE through a malicious SSH handshake.

Exploitarium is an open‑source security research repository by bikini that packages reproducible exploits for high‑impact CVEs. The libssh2 CVE‑2026‑55200 PoC targets a critical integer overflow in libssh2 versions through 1.11.1, where an unchecked packet_length field triggers an out‑of‑bounds write. This guide walks through the full exploitation workflow using the tools provided in the repository's libssh2-cve-2026-55200-poc/ directory.

Understanding the CVE‑2026‑55200 Vulnerability

The root cause lies in ssh2_transport_read() in the libssh2 source: the parser adds the attacker‑controlled 32‑bit packet_length to mac_len and auth_len before promoting the result to size_t.

When packet_length is set to 0xffffffff, the intermediate sum wraps to 15. The final allocation becomes 19 bytes (4 + 15) instead of a massive buffer. However, the original packet_length value remains in scope, causing subsequent code to reference packet_length‑1 against the tiny allocation—resulting in an out‑of‑bounds write with RCE potential.

Exploitarium's PoC decomposes this into four reproducible stages: arithmetic verification, malicious server deployment, vulnerable harness execution, and exploit‑driven code execution.

Verifying the Integer‑Wrap Bug with cve_2026_55200_probe.c

The first component validates the arithmetic behavior without needing a full network stack.

# Build the arithmetic verifier

gcc -std=c11 -Wall -Wextra -O0 -g -o cve_2026_55200_probe \
    libssh2-cve-2026-55200-poc/poc/cve_2026_55200_probe.c

# Run with the malicious packet length

./cve_2026_55200_probe --packet-length 0xffffffff --mac-len 0 --auth-len 16

Expected output: vulnerable32_allocation=19

This confirms the wrap‑around: 0xffffffff + 0 + 16 = 15 (truncated to 32 bits), plus 4 bytes of padding equals the undersized allocation that enables the exploit.

Deploying the Malicious SSH Server

The libpwn_cve_2026_55200_server.py script implements a minimal SSH server that delivers the crafted encrypted packet.

# Launch the malicious server on port 2222

python libssh2-cve-2026-55200-poc/poc/libpwn_cve_2026_55200_server.py \
    --serve --listen-host 0.0.0.0 --listen-port 2222

The server:

• Completes the SSH handshake to appear legitimate
• Transmits a packet whose decrypted packet_length field is 0xffffffff
• Waits for the target to process the malformed payload

This stage simulates the network‑delivered attack vector against vulnerable libssh2 clients.

Building and Running the Vulnerable Harness

libpwn_local_rce_harness.c provides a controlled target that replicates the libssh2 allocation‑to‑callback pattern without requiring the full library.

# Compile the vulnerable harness

gcc -O0 -g -Wall -Wextra -o libpwn_local_rce_harness \
    libssh2-cve-2026-55200-poc/poc/libpwn_local_rce_harness.c

The harness intentionally mirrors the vulnerable code path: it allocates based on the wrapped size, then uses the original packet_length to copy data—creating a reproducible crash or corruption target for exploit development.

Executing the Full RCE Exploit

The libpwn_local_rce_exploit.py driver automates the final exploitation phase: heap grooming, callback pointer overwrite, and proof‑of‑execution delivery.

# Run the exploit against the harness

python libssh2-cve-2026-55200-poc/poc/libpwn_local_rce_exploit.py \
    --harness ./libpwn_local_rce_harness \
    --proof ./libpwn_rce_proof.txt

# Verify successful code execution

cat libpwn_rce_proof.txt

Expected proof file contents:

RCE_PROOF=PASS
libpwn-rce-verified

The exploit works by:

1. Triggering the integer‑wrap allocation in the harness
2. Using the out‑of‑bounds write to corrupt adjacent heap metadata
3. Overwriting a function pointer with a controlled address
4. Redirecting execution to write the proof file

Key Files and Their Purposes

File	Location	Role
README.md	libssh2-cve-2026-55200-poc/	High‑level documentation and usage instructions
cve_2026_55200_probe.c	poc/	Stand‑alone arithmetic verifier
libpwn_cve_2026_55200_server.py	poc/	Malicious SSH server for payload delivery
libpwn_local_rce_harness.c	poc/	Controlled vulnerable target
libpwn_local_rce_exploit.py	poc/	Exploit driver with callback overwrite
2026-06-23-local-harness-output.txt	evidence/	Sample successful execution log

All paths are relative to libssh2-cve-2026-55200-poc/ within the bikini/exploitarium repository.

Adaptation Notes for Real‑World Targets

The provided PoC targets a local research harness by design. Porting to actual libssh2 deployments requires addressing:

• Allocator differences: The exploit assumes ptmalloc2 behavior; other allocators (jemalloc, tcmalloc) need different grooming strategies
• ASLR and PIE: The harness disables these for reproducibility; production targets require leak primitives or partial overwrite techniques
• Network delivery: The malicious server must be adapted to the target's connection initiation pattern (reverse vs. bind)

The repository's evidence/ directory contains reference outputs to validate your local setup before attempting adaptations.

Summary

Exploitarium's libssh2 CVE‑2026‑55200 PoC demonstrates a complete exploitation chain:

• Integer‑wrap verification via cve_2026_55200_probe.c
• Network‑based trigger via libpwn_cve_2026_55200_server.py
• Controlled crash surface via libpwn_local_rce_harness.c
• Callback‑overwrite RCE via libpwn_local_rce_exploit.py

The repository packages everything needed to understand, reproduce, and extend research on this critical libssh2 vulnerability.

Frequently Asked Questions

What versions of libssh2 are affected by CVE‑2026‑55200?

All libssh2 versions through 1.11.1 contain the vulnerable ssh2_transport_read() implementation. The flaw was introduced by performing 32‑bit arithmetic on packet_length before converting to size_t, enabling the integer wrap exploit demonstrated in Exploitarium.

Can this exploit work remotely against SSH servers?

The Exploitarium PoC is designed for local research and CTF scenarios. While the malicious server component (libpwn_cve_2026_55200_server.py) demonstrates network delivery, achieving reliable RCE against remote production servers requires significant adaptation for specific allocator configurations, ASLR, and target binaries.

Is the arithmetic verifier useful without running the full exploit?

Yes. cve_2026_55200_probe.c serves as a lightweight sanity check to confirm compiler and architecture behavior regarding 32‑bit unsigned integer overflow. Run it independently to verify your environment reproduces the vulnerable32_allocation=19 condition before investing time in the full exploit chain.

What mitigations block this exploit in practice?

Modern deployments with 64‑bit size_t still allocate tiny buffers due to the 32‑bit wrap, but subsequent hardening can impede exploitation: ASLR complicates target address prediction, Control‑Flow Integrity (CFI) blocks callback overwrites, and hardened allocators detect adjacent heap corruption. The Exploitarium harness intentionally disables these for educational clarity.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}