CVE-2026-48852
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
PuTTY versions 0.71 through 0.83 have an assertion failure in ECDSA signature verification. The issue is fixed in version 0.84.
Risk Assessment
An attacker could exploit this vulnerability to crash the PuTTY SSH client, potentially leading to denial of service or other adverse effects.
Recommendation
Update PuTTY to version 0.84 or later, which includes a fix for the assertion failure.
Other vulnerabilities in PuTTY
See all- CVE-2017-6542Critical
The ssh_agent_channel_data function in PuTTY before version 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message, leading to a buffer overflow.
- CVE-2026-48851Low
In PuTTY versions 0.77 through 0.83, the PuTTY icon is used as a trust indicator for TELNET data, but the trust status is not cleared between proxy authentication and the main session.
- CVE-2026-48850Low
PuTTY versions 0.72 through before 0.84 have a double free vulnerability in RSA KEX handling.
Original NVD description (English source)
PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS