CVE-2026-116775

LowCVSS 2.3

Published: 27/10/2026(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

pageant versions 0.2.0 through 0.2.5 trust a peer-controlled four-byte length prefix and buffer until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This is fixed in version 0.2.5.

Risk Assessment

A malicious SSH server can cause memory exhaustion in the client process using pageant, potentially leading to denial of service or application instability.

Recommendation

Update the pageant library to version 0.2.5 or later. Verify that the application does not bridge an SSH agent channel to the raw stream without limits.

Other vulnerabilities in pageant

CVE-2026-102820Medium
pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.

Original NVD description (English source)

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte length prefix and buffers until len + 4 bytes are available without checking the fixed _AGENT_MAX_MSGLEN transport capacity. An application that bridges an SSH forwarded-agent channel to the raw stream can allow a malicious server to force large allocations or retain a partially filled frame, causing client memory exhaustion. This issue is fixed in version 0.2.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS