CVE-2019-9896
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting...
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
- Record
CVE-2019-9896- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-427
- Updated
- 2026-11-02
CVE List No score
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
- Record
CVE-2019-9896- Updated
- 2026-11-02
EUVDEUVD-2019-19252 No score
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
- Record
EUVD-2019-19252- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x5pv-35h7-pm8q
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting...
In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable.
- Record
GHSA-x5pv-35h7-pm8q- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1113-1 No score
Security update for putty
This update for putty fixes the following issues:
Update to new upstream release 0.71 [boo#1129633]
- CVE-2019-9894: Fixed a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification potential recycling of random numbers used in cryptography.
- CVE-2019-9895: Fixed a remotely triggerable buffer overflow in any kind of server-to-client forwarding.
- CVE-2019-9897: Fixed multiple denial-of-service attacks that can be triggered by writing to the terminal.
- CVE-2019-9898: Fixed potential recycling of random numbers used in cryptography
- CVE-2019-9896 (Windows only): Fixed hijacking by a malicious help file in the same directory as the executable
- Major rewrite of the crypto code to remove cache and timing side channels.
- Record
openSUSE-SU-2019:1113-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1123-1 No score
Security update for putty
This update for putty fixes the following issues:
Update to new upstream release 0.71 [boo#1129633]
- CVE-2019-9894: Fixed a remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification potential recycling of random numbers used in cryptography.
- CVE-2019-9895: Fixed a remotely triggerable buffer overflow in any kind of server-to-client forwarding.
- CVE-2019-9897: Fixed multiple denial-of-service attacks that can be triggered by writing to the terminal.
- CVE-2019-9898: Fixed potential recycling of random numbers used in cryptography
- CVE-2019-9896 (Windows only): Fixed hijacking by a malicious help file in the same directory as the executable
- Major rewrite of the crypto code to remove cache and timing side channels.
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:1123-1- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | yasinyilmaz/vuln-chm-hijack | 2019-05-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9896 is a high vulnerability (CVSS 7.8) in Putty, published March 21, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. No source names a fixed version.
References
chiark.greenend.org.uk/~sgtatham/putty/changes.html
lists.opensuse.org/opensuse-security-announce/2019-04/msg00004.html
security.netapp.com/advisory/ntap-20190404-0001
nvd.nist.gov/vuln/detail/CVE-2019-9896
github.com/advisories/GHSA-x5pv-35h7-pm8q
Show 8 moreShow less
bugzilla.suse.com/1129633
suse.com/security/cve/CVE-2019-9894