CVE-2026-48850

What it actually does

PuTTY versions 0.72 through versions before 0.84 contain a double-free memory management flaw in the RSA key exchange implementation. During SSH connection negotiation, a malformed or unusual RSA key exchange sequence can cause PuTTY to free the same memory object more than once, leading to process instability and likely client crash. Based on the provided CVSS vector, the expected impact is limited to availability of the PuTTY client process, with no confirmed confidentiality or integrity impact and no known public exploit maturity.

Why it matters to the business

Successful exploitation can interrupt SSH sessions by crashing the PuTTY client, potentially disrupting administrators, support staff, automation operators, or users who rely on PuTTY for remote access. The business risk is generally low because exploitation is rated high-complexity, there is no known exploitation, EPSS is low, and the flaw is not listed in CISA KEV; however, organizations with broad PuTTY deployment should still upgrade because SSH clients are commonly used for privileged administrative access.

How an attack unfolds

An attacker would need to position a malicious or attacker-controlled SSH server, or otherwise influence a user or automated workflow to connect to such a server using an affected PuTTY version. During SSH handshake negotiation, the server would steer the session into RSA key exchange behavior that triggers the double-free condition in vulnerable PuTTY builds. If successful, the PuTTY process may terminate unexpectedly, disconnecting the session. The provided scoring indicates exploitation requires high complexity and does not provide direct code execution, credential theft, or data modification based on currently available information.

How to fix it

Upgrade PuTTY to version 0.84 or later across all systems where PuTTY is installed or packaged. If immediate upgrade is not possible, reduce exposure by avoiding connections to untrusted SSH servers, using alternative patched SSH clients for high-risk workflows, and limiting administrative SSH access to known, trusted hosts. Because no exact fixed package versions were provided beyond the upstream version boundary, use vendor or distribution advisories to identify the corrected package for each platform and verify that packaged PuTTY builds correspond to upstream 0.84 or later.

How to confirm the fix worked

Confirm installed PuTTY versions are 0.84 or later by checking the application About dialog, executable metadata, package manager inventory, software asset management tools, or endpoint management records. Validate that older standalone copies of putty.exe, pageant.exe, plink.exe, pscp.exe, and psftp.exe are not left in user profile directories, shared tool folders, scripts, or portable software locations. Where patch validation testing is required, confirm that connections to trusted SSH servers complete normally after upgrade and that vulnerable versions are no longer present in software inventory scans.

Typical attack path

1. Identify users or workflows that use PuTTY versions 0.72 through before 0.84 to initiate SSH sessions.
2. Operate or compromise an SSH server that the victim may connect to, or otherwise induce connection to an attacker-controlled endpoint.
3. Negotiate RSA key exchange parameters crafted to trigger the vulnerable memory handling path.
4. Trigger the double-free condition during SSH key exchange.
5. Cause the PuTTY client process to crash or terminate, disrupting the SSH session.

How to detect it

To assess possible prior exploitation, review endpoint crash telemetry, Windows Event Logs, EDR process events, and application reliability records for PuTTY-family processes terminating unexpectedly during or immediately after outbound SSH connections. Correlate crashes of putty.exe, plink.exe, pscp.exe, or psftp.exe with network logs showing TCP connections to port 22 or other SSH service ports, especially to unfamiliar external hosts. Investigate repeated crashes tied to the same remote SSH endpoint, newly contacted servers, or sessions where host key prompts or key exchange failures occurred. Because the known impact is availability and no specific public exploit artifacts are provided, detection should focus on crash patterns, anomalous SSH destinations, and use of vulnerable PuTTY versions rather than durable host indicators.

• putty.exe
• plink.exe
• pscp.exe
• psftp.exe
• Application Error
• Faulting application name: putty.exe
• Faulting application name: plink.exe
• Faulting application name: pscp.exe
• Faulting application name: psftp.exe
• Windows Error Reporting
• PuTTY Fatal Error
• TCP/22

What your security team should do

• Inventory PuTTY installations and prioritize upgrade of versions 0.72 through before 0.84, especially on administrator workstations and jump-host workflows.
• Deploy PuTTY 0.84 or later from trusted vendor sources and remove older portable binaries from user-writeable folders and shared tool repositories.
• Monitor for repeated PuTTY crashes during SSH connection negotiation, especially when associated with connections to unfamiliar or newly observed SSH servers.
• Restrict administrative SSH workflows to trusted server inventories and discourage users from connecting PuTTY to unverified hosts.
• Because this issue is not in CISA KEV, has low EPSS, and has no known exploit maturity, handle through standard patch cadence unless PuTTY is widely deployed in privileged operational workflows.