Executive brief
Tera Term is a popular open-source terminal emulator used to connect to remote servers via SSH. A vulnerability in its SSH plugin could allow a malicious server or a man-in-the-middle attacker to trigger memory errors when a user attempts to connect. This could result in the accidental exposure of sensitive information from the computer's memory to the attacker or cause the application to crash.
Technical details
An unsigned-to-signed conversion error (CWE-196) exists in the TTSSH2 plugin of Tera Term. When the application attempts to establish an SSH connection to a malicious server or is subjected to a man-in-the-middle attack, specially crafted packets can trigger out-of-bounds read and write operations. The out-of-bounds read may cause adjacent memory contents to be transmitted to the server, leading to information disclosure. The out-of-bounds write is limited to a temporary null-byte insertion and subsequent restoration, which can cause unexpected behavior or a denial-of-service (crash). The issue is resolved in TTSSH2 version 3.6.2, bundled with Tera Term 5.6.2.
Affected products
- TeraTerm Project TTSSH2 1.00 alpha1 through 3.6.1
- TeraTerm Project Tera Term 2.05 through 5.6.1
Timeline
- 2026-07-15: disclosed: Initial release of security advisory by TeraTerm Project
- 2026-07-16: patched: TTSSH2 3.6.2 (Tera Term 5.6.2) released to address the issue
- 2026-07-17: advisory: NVD and JVN advisories published