VIR Vulnerability Intelligence Relay

CVE-2026-48852

low
Published 2026-05-25 · Modified 2026-05-27
CVSS v3
3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v2
—
VIR risk
3.7

Description

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

Predictions

Exploit likelihood
47%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2026-48852

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ecdsa-remotely-triggerable-assertion.html

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html

OS impact
OSVersionStatusFixed in
debian debianbookwormaffected
debian debianbullseyeaffected
debian debianforkyaffected
debian debiansidfixed0.84-1
debian debiantrixieaffected

Application impact
VendorProductVersionsFixed
puttyputty{"startIncluding":"0.71","endExcluding":"0.84"}0.84

References

CWEs

CWE-617

Verify integrity in audit chain (admin only). AS-IS.