What is the CVSS score of CVE-2026-48850?

CVE-2026-48850 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48850?

Yes, a patch is available for CVE-2026-48850. Update the affected software to the latest version immediately.

PuTTY CVE-2026-48850

EUVD-2026-31729 LOW

Double Free (CWE-415)

2026-05-25 mitre

GHSA-c27j-mcjp-93gg

Information Disclosure Putty

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:34 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

PuTTY 0.72 before 0.84 has a double free in RSA KEX.

AnalysisAI

Double free in PuTTY's RSA key exchange implementation affects versions 0.72 through 0.83, creating a memory corruption condition that can crash the client when connecting to a server that negotiates RSA KEX. The CVSS vector (AV:N/AC:H/PR:N/UI:N/A:L) reflects a network-reachable but high-complexity trigger with only limited availability impact, consistent with a difficult-to-reproduce crash rather than reliable code execution. No active exploitation is confirmed per CISA KEV, SSVC reports exploitation status as none, and EPSS sits at 0.04% (12th percentile), indicating low real-world exploitation pressure at time of analysis.

Technical ContextAI

PuTTY is a widely used open-source SSH and Telnet client (CPE: cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-415 (Double Free), a memory-safety flaw where a heap-allocated buffer is freed more than once during RSA key exchange (RSA KEX) - the phase of the SSH handshake where asymmetric cryptography is used to negotiate session keys. In PuTTY's RSA KEX code path, a code path error causes the same memory region to be released twice, corrupting the heap allocator's internal state. While double-free conditions can theoretically be escalated to arbitrary code execution via heap feng shui techniques, the AC:H rating and low CVSS score suggest the practical exploitability is constrained by timing, heap layout, or other environmental factors. The vulnerability is present across versions 0.72 up to (but not including) 0.84, per both EUVD-2026-31729 and the upstream vendor advisory.

RemediationAI

Upgrade to PuTTY 0.84 or later, the vendor-released patch confirmed via the official PuTTY announcement mailing list (https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html). The upstream maintainer's wishlist entry (https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/rsakex-double-free.html) provides additional context on the fix. If immediate upgrade is not possible, a specific compensating control is to configure PuTTY's SSH key exchange algorithm list to exclude RSA KEX methods (e.g., rsa2048-sha256, rsa1024-sha1) and enforce only non-RSA key exchange algorithms such as ECDH or curve25519-sha256 in PuTTY's connection settings under SSH > Kex. This prevents the vulnerable code path from being exercised entirely, though it may cause compatibility issues with older SSH servers that support only RSA KEX. Enterprise deployments using centrally managed PuTTY configurations (e.g., via Pageant or Plink in scripts) should apply the upgrade promptly to avoid unmanaged exposure.