Quick answers
- Is CVE-2026-48850 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48850 being exploited in the wild.
- How severe is CVE-2026-48850?
- Low severity, with a CVSS score of 3.7, published 25 May 2026.
- Which products and versions are affected?
- Putty 0.72 to 0.83.
- Is there a fix for CVE-2026-48850?
- A patch was published on 2026-05-22: PuTTY 0.84 released fixing the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48850 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-48850?
- Check whether you run Putty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A double-free vulnerability (CWE-415) exists in PuTTY's implementation of RSA Key Exchange (RFC 4432). The flaw occurs in the error-handling path when a server sends an unexpectedly short RSA key; the code calls a specialized free function (ssh_rsakex_freekey) that deallocates the entire structure, followed by a standard free call on the same structure. This can be triggered by a malicious server or a Man-in-the-Middle (MITM) attacker during the KEXINIT phase before host key verification. While the primary impact is a remote-triggerable crash (denial of service), the vendor notes no known path to arbitrary code execution. The issue is fixed in version 0.84.
Affected products
- PuTTY PuTTY 0.72 to 0.83
Timeline
- 2026-05-22: patched: PuTTY 0.84 released fixing the issue
- 2026-05-25: disclosed: CVE-2026-48850 published