CVE-2026-48851
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but...
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
EUVDEUVD-2026-31731
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
EUVD-2026-31731- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5fwp-h8j4-xmhm
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but...
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
GHSA-5fwp-h8j4-xmhm- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
NVD
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-451
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-48851
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
DEBIAN-CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-48851
PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.
- Record
UBUNTU-CVE-2026-48851- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12168-1No score
putty-0.85-2.1 on GA media
These are all security issues fixed in the putty-0.85-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12168-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22127-1No score
Security update for putty
This update for putty fixes the following issues:
Changes in putty:
Update to release 0.85
- Fixed a remotely triggerable use-after-free in Pageant.
- Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. (Only used if a server supports nothing else.)
- Fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. (Only triggerable on purpose if you let somebody else generate a key for you.)
- Denial-of-service security fixes for where a server could trigger a tight loop in PuTTY, and even a MITM can make it consume unlimited memory at startup.
Fixed double free in RSA KEX error handling path can be triggered if the key sent by the server is unexpectedly short [boo#1266375, CVE-2026-48850]
Fixed assertion failure in ECDSA signature verification can be triggered during initial key exchange via a crafted host key and signature [boo#1266373, CVE-2026-48852]
Fixed TELNET session data is marked with trust sigils after authenticating to a proxy and allows for password prompt spoofing [boo#1266374, CVE-2026-48851]
- Record
openSUSE-SU-2026:22127-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puttyDebian:12 | All versions, plus listed versions 0.78-20.78-2+deb12u10.78-2+deb12u20.78-30.79-1 Show 11 moreShow less0.80-10.81-10.81-20.81-30.82-10.82-20.83-10.83-20.83-30.84-10.85-3 | None known |
puttyDebian:13 | All versions, plus listed versions 0.83-30.84-10.85-3 | None known |
puttyDebian:14 | before 0.84-1, plus listed versions 0.83-3 | 0.84-1 |
puttyUbuntu:16.04:LTS | All versions, plus listed versions 0.65-20.66-10.66-20.66-30.66-4 Show 4 moreShow less0.67-10.67-20.67-3build0.16.04.10.67-3+deb9u1build0.16.04.1 | None known |
puttyUbuntu:18.04:LTS | All versions, plus listed versions 0.70-10.70-20.70-30.70-4 | None known |
puttyUbuntu:20.04:LTS | All versions, plus listed versions 0.72-10.73-10.73-2 | None known |
puttyUbuntu:22.04:LTS | All versions, plus listed versions 0.75-30.76-10.76-2 | None known |
puttyUbuntu:24.04:LTS | All versions, plus listed versions 0.78-30.79-10.80-10.80-1build20.80-1build30.81-1 | None known |
puttyUbuntu:25.10 | All versions, plus listed versions 0.83-20.83-3 | None known |
puttyUbuntu:26.10 | All versions, plus listed versions 0.83-3build10.84-1 | None known |
puttyUbuntu:26.04:LTS | All versions, plus listed versions 0.83-30.83-3build1 | None known |
puttyopenSUSE:Tumbleweed From an advisory covering 3 CVEs | before 0.85-2.1 | 0.85-2.1 |
puttyopenSUSE:Leap 16.0 From an advisory covering 3 CVEs | before 0.85-bp160.1.1 | 0.85-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48851 is a low vulnerability (CVSS 3.1) in Putty, published May 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in putty 0.84-1.