# CVE-2026-102820: pageant out-of-bounds read in Windows shared-memory message handler

Source: https://junglewise.ai/threats/cve-2026-102820-pageant-provides-a-pageantstream-type-that-implements-asyncread  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102820 · Severity: medium · CVSS 6.2 · Published 2026-09-29

The pageant SSH agent library for Windows contains a flaw in how it reads responses from the Pageant window service. A local attacker who can impersonate the Pageant window can send malicious messages that cause the library to allocate up to 4 GB of memory and read beyond valid boundaries, crashing SSH clients that use the library and potentially leaking sensitive data from memory.

Technologies: [Eugeny Russh](https://junglewise.ai/threats/technologies/eugeny-russh). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Eugeny](https://junglewise.ai/threats/vendors/eugeny).

## Quick answers

**Is CVE-2026-102820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102820 being exploited in the wild.

**How severe is CVE-2026-102820?** Medium severity, with a CVSS score of 6.2, published 29 September 2026.

**Which products and versions are affected?** pageant (crates.io) <= 0.2.2, SEMVER:introduced=0,fixed=0.2.3; Eugeny Pageant before 0.2.3; Eugeny Russh before 0.63.2.

**Is there a fix for CVE-2026-102820?** Yes. pageant (crates.io): upgrade to 0.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102820 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-102820?** Check whether you run pageant (crates.io), Eugeny Pageant or Eugeny Russh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pageant (crates.io): upgrade to 0.2.3 or later

  ```sh
  cargo update -p pageant
  ```


## Technical details

The vulnerability exists in pageant/src/wmmessage.rs MemoryMap::read function, which trusts a peer-controlled u32 response length from the 8192-byte Pageant shared-memory mapping without proper bounds validation. A local process impersonating the Pageant window can trigger oversized allocations and out-of-bounds reads via query_pageant_direct. The flaw affects russh versions before 0.63.2 / pageant before 0.2.3 and requires local network access and the ability to create a window matching Pageant's name.

## Affected products

- Eugeny russh before 0.63.2
- Eugeny pageant before 0.2.3

## Identifiers

- CVE-2026-102820
- GHSA-g4mp-vgx3-xrvm

## Timeline

- 2026-09-29: disclosed
- 2026-09-29: patched: pageant 0.2.3 and russh 0.63.2 released

## References

- [https://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b](https://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b)
- [https://github.com/Eugeny/russh/releases/tag/v0.63.2](https://github.com/Eugeny/russh/releases/tag/v0.63.2)

## Related threats

- [russh SSH server signature algorithm mismatch in publickey auth](https://junglewise.ai/threats/cve-2026-111062-a-russh-ssh-server-accepts-a-publickey-authentication-whose)
- [russh SSH agent confirmation bypass](https://junglewise.ai/threats/cve-2026-116794-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [pageant PageantStream unbounded frame buffering](https://junglewise.ai/threats/cve-2026-116775-pageant-provides-a-pageantstream-type-that-implements-asyncread)
- [russh SSH agent unbounded memory allocation via constraint records](https://junglewise.ai/threats/cve-2026-111061-russh-is-a-rust-ssh-client-and-server-library-that-includes-an)
- [Russh hybrid ML-KEM key exchange validation bypass](https://junglewise.ai/threats/cve-2026-102824-russh-is-a-rust-ssh-client-and-server-library-prior-to-0-63-0)