CVE-2026-48852 - Vulnerability Details - OpenCVE

PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Putty	Putty

Configuration 1 [-]

cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ecdsa-remotely-triggerable-assertion.html

History

Tue, 26 May 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 25 May 2026 22:45:00 +0000

Type	Values Removed	Values Added
Title		Assertion Failure in ECDSA Host Key Verification in PuTTY

Mon, 25 May 2026 20:45:00 +0000

Type	Values Removed	Values Added
Description		PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.
First Time appeared		Putty Putty putty
Weaknesses		CWE-617
CPEs		cpe:2.3:a:putty:putty::::::::
Vendors & Products		Putty Putty putty
References		https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ecdsa-remotely-triggerable-assertion.html
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-05-25T20:19:20.809Z

Updated: 2026-05-26T12:39:14.852Z

Reserved: 2026-05-25T20:19:20.308Z

Link: CVE-2026-48852

Vulnrichment

Updated: 2026-05-26T12:39:12.140Z

NVD

Status : Analyzed

Published: 2026-05-25T21:16:35.543

Modified: 2026-05-27T19:11:47.077

Link: CVE-2026-48852

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48852", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-05-25T20:19:20.308Z", "datePublished": "2026-05-25T20:19:20.809Z", "dateUpdated": "2026-05-26T12:39:14.852Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PuTTY", "vendor": "PuTTY", "versions": [{"lessThan": "0.84", "status": "affected", "version": "0.71", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-617", "description": "CWE-617 Reachable Assertion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-25T20:19:20.809Z"}, "references": [{"url": "https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html"}, {"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ecdsa-remotely-triggerable-assertion.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.71", "versionEndExcluding": "0.84"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T12:39:09.980944Z", "id": "CVE-2026-48852", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T12:39:14.852Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48852", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T12:39:09.980944Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T12:39:12.140Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PuTTY", "product": "PuTTY", "versions": [{"status": "affected", "version": "0.71", "lessThan": "0.84", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html"}, {"url": "https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/ecdsa-remotely-triggerable-assertion.html"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617 Reachable Assertion"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.84", "versionStartIncluding": "0.71"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-05-25T20:19:20.809Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48852", "state": "PUBLISHED", "dateUpdated": "2026-05-26T12:39:14.852Z", "dateReserved": "2026-05-25T20:19:20.308Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-05-25T20:19:20.809Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}