EUVD-2026-45140
GHSA-mmcg-pw3p-cwjh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker requires no privileges and exploits over network (AV:N, PR:N), but victim must initiate connection to malicious server (UI:R); partial C/I/A impacts reflect bounded OOB access rather than full compromise.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
AnalysisAI
Out-of-bounds memory read and write in Tera Term's TTSSH2 SSH plugin exposes users who connect to attacker-controlled SSH servers to memory disclosure and potential client crashes. The root cause is an unsigned-to-signed integer conversion error (CWE-196) in the SSH connection handshake code, which can cause internal memory contents to be transmitted to the malicious server. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the network-reachable nature with no privilege requirement on the attacker side makes social-engineering lures a realistic delivery vector.
Technical ContextAI
TTSSH2 is the SSH subsystem plugin bundled with Tera Term, a widely used open-source terminal emulator for Windows maintained by TeraTerm Project. CWE-196 (Unsigned to Signed Conversion Error) occurs when a value typed as an unsigned integer is reinterpreted as a signed integer without bounds validation; if the high bit is set, the result is treated as a large negative number, causing array indexing or length calculations to underflow and access memory outside intended buffers. In an SSH handshake context, this class of bug typically appears in packet-length or field-length parsing, where the sign flip causes the code to read or write past buffer boundaries. The CPE string cpe:2.3:a:teraterm_project:ttssh2:*:*:*:*:*:*:*:* covers all known versions of TTSSH2 without a specified upper bound, indicating the affected range has not been narrowed in the available data. The JVN advisory (JVN#65294474) published by JPCERT/CC is the primary authoritative source.
RemediationAI
The primary remediation is to upgrade Tera Term to the fixed version specified in the vendor advisory at https://teratermproject.github.io/SA/JVN65294474-en.html - no exact patched version number was included in the available input data, so users must consult that page directly. As a compensating control pending upgrade, users should avoid connecting to SSH servers that are not explicitly trusted and operated by known parties; disabling the TTSSH2 plugin entirely in environments where SSH connectivity via Tera Term is not operationally required eliminates the attack surface. Network-level controls such as egress filtering to restrict outbound SSH (TCP 22) connections to an allowlist of trusted server IP addresses also constrain the exposure. The JPCERT/CC advisory is available at https://jvn.jp/en/jp/JVN65294474/.
Same weakness CWE-196 – Unsigned to Signed Conversion Error
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today