PT-2026-127232
CVE-2026-116775
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
CVSS 4.0
2.3
LowMetricsAV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
pageant versions 0.2.0 through 0.2.4
Description
The
PageantStream type, which implements AsyncRead and AsyncWrite traits for communication with a Pageant instance, contains a flaw in the PageantStream::new() function within pageant/src/wmmessage.rs. The function trusts a four-byte length prefix controlled by the peer and buffers data until len + 4 bytes are available, failing to verify the AGENT MAX MSGLEN transport capacity. In applications bridging an SSH forwarded-agent channel to the raw stream, a malicious server can trigger large memory allocations or maintain partially filled frames, leading to client memory exhaustion.Recommendations
Update pageant to version 0.2.5.
Found an issue in the description? Have something to add? Feel free to write us 👾