diff --git a/pkgs/by-name/li/libgit2/fix-ssh-custom-heap-buffer-overflow.patch b/pkgs/by-name/li/libgit2/fix-ssh-custom-heap-buffer-overflow.patch
new file mode 100644
index 000000000000..8c8550a1ce2b
--- /dev/null
+++ b/pkgs/by-name/li/libgit2/fix-ssh-custom-heap-buffer-overflow.patch
@@ -0,0 +1,31 @@
+commit 4277cc75bc147d0af6ffddc7db96f48492977968
+Author: bakersdozen123 <taunts_bakers_3r@icloud.com>
+Date:   Sat Oct 11 09:56:48 2025 -0700
+
+    ssh: fix custom ssh heap buffer overflow
+    
+    The `ssh_custom_free()` function calls `strlen()` on the `publickey`
+    field, which stores binary data, not a null-terminated string. This
+    causes a heap buffer overflow when the public key data is not
+    null-terminated or contains embedded null bytes.
+    
+    The `publickey` field stores binary data, as required by the underlying
+    `libssh2_userauth_publickey()` function, which accepts a public key
+    parameter of the type `const unsigned char*`.
+    
+    Use the stored `publickey_len` instead of `strlen()` to determine the
+    correct buffer size.
+
+diff --git a/src/libgit2/transports/credential.c b/src/libgit2/transports/credential.c
+index b47bd63a1..7d0eacecf 100644
+--- a/src/libgit2/transports/credential.c
++++ b/src/libgit2/transports/credential.c
+@@ -161,7 +161,7 @@ static void ssh_custom_free(struct git_credential *cred)
+ 
+ 	if (c->publickey) {
+ 		/* Zero the memory which previously held the publickey */
+-		size_t key_len = strlen(c->publickey);
++		size_t key_len = c->publickey_len;
+ 		git__memzero(c->publickey, key_len);
+ 		git__free(c->publickey);
+ 	}
diff --git a/pkgs/by-name/li/libgit2/package.nix b/pkgs/by-name/li/libgit2/package.nix
index a46c13c4bcca..a244a72cfa3d 100644
--- a/pkgs/by-name/li/libgit2/package.nix
+++ b/pkgs/by-name/li/libgit2/package.nix
@@ -39,6 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-/xI3v7LNhpgfjv/m+sZwYDhhYvS6kQYxiiiG3+EF8Mw=";
   };
 
+  patches = [
+    # https://github.com/libgit2/libgit2/pull/7146
+    ./fix-ssh-custom-heap-buffer-overflow.patch
+  ];
+
   cmakeFlags = [
     "-DREGEX_BACKEND=pcre2"
     "-DUSE_HTTP_PARSER=llhttp"
diff --git a/pkgs/tools/package-management/nix/dependencies.nix b/pkgs/tools/package-management/nix/dependencies.nix
index ed5a63ce3ecf..7f3b5780607a 100644
--- a/pkgs/tools/package-management/nix/dependencies.nix
+++ b/pkgs/tools/package-management/nix/dependencies.nix
@@ -34,5 +34,12 @@ regular@{
       # only a stripped down version is built which takes a lot less resources to build
       requiredSystemFeatures = [ ];
     };
+
+    libgit2 = pkgs.libgit2.overrideAttrs (old: {
+      # Drop the SSH buffer overflow patch to avoid rebuilding Nix
+      patches = lib.filter (p: !lib.hasSuffix "fix-ssh-custom-heap-buffer-overflow.patch" (toString p)) (
+        old.patches or [ ]
+      );
+    });
   };
 }