CVE-2026-48852

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

These are all security issues fixed in the putty-0.85-2.1 package on the GA media of openSUSE Tumbleweed.

This update for putty fixes the following issues:

Changes in putty:

• Update to release 0.85

  • Fixed a remotely triggerable use-after-free in Pageant.
  • Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. (Only used if a server supports nothing else.)
  • Fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. (Only triggerable on purpose if you let somebody else generate a key for you.)
  • Denial-of-service security fixes for where a server could trigger a tight loop in PuTTY, and even a MITM can make it consume unlimited memory at startup.

• Fixed double free in RSA KEX error handling path can be triggered if the key sent by the server is unexpectedly short [boo#1266375, CVE-2026-48850]

• Fixed assertion failure in ECDSA signature verification can be triggered during initial key exchange via a crafted host key and signature [boo#1266373, CVE-2026-48852]

• Fixed TELNET session data is marked with trust sigils after authenticating to a proxy and allows for password prompt spoofing [boo#1266374, CVE-2026-48851]