Executive brief
Tera Term is a popular open-source terminal emulator used to connect to remote servers via SSH. A vulnerability in its SSH plugin (TTSSH2) allows a malicious server or a man-in-the-middle attacker to trigger memory errors when a user attempts to connect. This can lead to the accidental transmission of sensitive data from the user's computer memory to the attacker's server or cause the application to crash.
Technical details
An Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in the TTSSH2 plugin of Tera Term. The flaw is triggered when the client processes specially crafted packets from a malicious SSH server or a man-in-the-middle attacker. This results in an out-of-bounds read or write; while the write is limited to a temporary null-byte, the out-of-bounds read can cause adjacent memory regions to be included in data transmitted back to the server. The vulnerability affects TTSSH2 versions 1.00 alpha1 through 3.6.1 (bundled in Tera Term 2.05 through 5.6.1). A fix is available in TTSSH2 3.6.2 (Tera Term 5.6.2), though no fix is planned for the legacy 4.x branch.
Affected products
- TeraTerm Project TTSSH2 1.00 alpha1 through 3.6.1
- TeraTerm Project Tera Term 2.05 through 5.6.1
Timeline
- 2026-07-15: disclosed: Initial release of security advisory by TeraTerm Project
- 2026-07-16: patched: TTSSH2 3.6.2 (Tera Term 5.6.2) released to address the issue
- 2026-07-17: advisory: NVD and JVN advisories published