Is CVE-2026-48852 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48852 being exploited in the wild.

How severe is CVE-2026-48852?

Low severity, with a CVSS score of 3.7, published 25 May 2026.

Is there a fix for CVE-2026-48852?

A patch was published on 2026-05-22: Fixed in version 0.84 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48852 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48852?

Check whether you run Putty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48852: PuTTY assertion failure in ECDSA signature verification

CVE-2026-48852 · Severity: low · CVSS 3.7 · Published 2026-05-25

PuTTY, a popular tool for connecting to remote servers, is vulnerable to a crash during the initial connection phase. A malicious server or an attacker positioned between the user and the server can send specially crafted security keys that cause the application to shut down unexpectedly. While this does not allow an attacker to steal data or take over a system, it can result in the loss of terminal scrollback history if the user was reusing an existing window.

Technologies: Putty. Vendors: Putty.

Quick answers

Is CVE-2026-48852 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48852 being exploited in the wild.
How severe is CVE-2026-48852?: Low severity, with a CVSS score of 3.7, published 25 May 2026.
Which products and versions are affected?: Putty 0.71 to 0.83.
Is there a fix for CVE-2026-48852?: A patch was published on 2026-05-22: Fixed in version 0.84 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48852 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48852?: Check whether you run Putty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An assertion failure (CWE-617) exists in PuTTY's elliptic curve arithmetic logic when processing NIST Weierstrass curves (P256, P384, and P521). The vulnerability is triggered when the application attempts to add two elliptic curve points with identical y-coordinates during host key signature verification. An unauthenticated remote attacker or Man-in-the-Middle (MITM) can trigger this crash by providing a malicious host key and signature during the initial SSH key exchange. Because verification occurs before the host key is validated against the local cache, the crash happens before any host key warnings are displayed. The issue is resolved in version 0.84.

Affected products

PuTTY PuTTY 0.71 to 0.83

Timeline

2026-05-22: patched: Fixed in version 0.84
2026-05-25: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.