CVE-2026-48851
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but...
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
EUVDEUVD-2026-31731
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
EUVD-2026-31731- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5fwp-h8j4-xmhm
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but...
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
GHSA-5fwp-h8j4-xmhm- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
NVD
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-48851
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
DEBIAN-CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-48851
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
UBUNTU-CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12168-1 No score
putty-0.85-2.1 on GA media
These are all security issues fixed in the putty-0.85-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12168-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22127-1 No score
Security update for putty
This update for putty fixes the following issues:
Changes in putty:
-
Update to release 0.85
- Fixed a remotely triggerable use-after-free in Pageant.
- Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. (Only used if a server supports nothing else.)
- Fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. (Only triggerable on purpose if you let somebody else generate a key for you.)
- Denial-of-service security fixes for where a server could trigger a tight loop in PuTTY, and even a MITM can make it consume unlimited memory at startup.
-
Fixed double free in RSA KEX error handling path can be triggered if the key sent by the server is unexpectedly short [boo#1266375, CVE-2026-48850]
-
Fixed assertion failure in ECDSA signature verification can be triggered during initial key exchange via a crafted host key and signature [boo#1266373, CVE-2026-48852]
-
Fixed TELNET session data is marked with trust sigils after authenticating to a proxy and allows for password prompt spoofing [boo#1266374, CVE-2026-48851]
- Record
openSUSE-SU-2026:22127-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puttyDebian:12 |
All versions, plus listed versions 0.78-20.78-2+deb12u10.78-2+deb12u20.78-30.79-1 Show 11 moreShow less0.80-10.81-10.81-20.81-30.82-10.82-20.83-10.83-20.83-30.84-10.85-3 |
None known |
puttyDebian:13 |
All versions, plus listed versions 0.83-30.84-10.85-3 |
None known |
puttyDebian:14 |
before 0.84-1, plus listed versions 0.83-3 |
0.84-1 |
puttyUbuntu:16.04:LTS |
All versions, plus listed versions 0.65-20.66-10.66-20.66-30.66-4 Show 4 moreShow less0.67-10.67-20.67-3build0.16.04.10.67-3+deb9u1build0.16.04.1 |
None known |
puttyUbuntu:18.04:LTS |
All versions, plus listed versions 0.70-10.70-20.70-30.70-4 |
None known |
puttyUbuntu:20.04:LTS |
All versions, plus listed versions 0.72-10.73-10.73-2 |
None known |
puttyUbuntu:22.04:LTS |
All versions, plus listed versions 0.75-30.76-10.76-2 |
None known |
puttyUbuntu:24.04:LTS |
All versions, plus listed versions 0.78-30.79-10.80-10.80-1build20.80-1build30.81-1 |
None known |
puttyUbuntu:25.10 |
All versions, plus listed versions 0.83-20.83-3 |
None known |
puttyUbuntu:26.10 |
All versions, plus listed versions 0.83-3build10.84-1 |
None known |
puttyUbuntu:26.04:LTS |
All versions, plus listed versions 0.83-30.83-3build1 |
None known |
puttyopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 0.85-2.1 | 0.85-2.1 |
puttyopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 0.85-bp160.1.1 | 0.85-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48851 is a low vulnerability (CVSS 3.1) in Putty, published May 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in putty 0.84-1.