EUVD-2026-45139
GHSA-qcvw-2hm7-q2rp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector confirmed by SSH protocol; PR:N because attacker controls the server and needs no client-side credentials; UI:R because victim must initiate the connection.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
AnalysisAI
Out-of-bounds read/write in the TTSSH2 SSH plugin of Tera Term exposes users who connect to attacker-controlled SSH servers to memory disclosure and process crashes. A malicious SSH server can send crafted packets with inconsistent length parameters during connection establishment, causing the TTSSH2 plugin to read and write beyond allocated buffer boundaries - leaking adjacent memory contents (potentially including session data or credentials) back to the attacker's server. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and unauthenticated server-side position make this a credible threat for Tera Term users in environments where they may connect to untrusted SSH endpoints.
Technical ContextAI
The vulnerability resides in the TTSSH2 plugin (CPE: cpe:2.3:a:teraterm_project:ttssh2:*:*:*:*:*:*:*:*), the SSH2 implementation bundled with the Tera Term terminal emulator for Windows. CWE-130 (Improper Handling of Length Parameter Inconsistency) identifies the root cause: the plugin fails to properly reconcile declared versus actual length fields in SSH protocol messages received during handshake, a classic pattern in binary protocol parsers where a length field is trusted without validation against buffer boundaries. The tags 'Buffer Overflow' and 'Ttssh2' confirm that the inconsistency results in memory safety violations - both out-of-bounds read (leaking memory to the server) and out-of-bounds write (potential for memory corruption). Reported and coordinated by JPCERT/CC under JVN#65294474, indicating this followed Japan's coordinated disclosure process.
RemediationAI
Consult the TeraTerm Project security advisory at https://teratermproject.github.io/SA/JVN65294474-en.html for the official patched release version - no specific fixed version number was present in the intelligence data available for this analysis, so the exact upgrade target must be confirmed from the advisory before patching. As a compensating control for environments that cannot immediately upgrade, restrict Tera Term users from connecting to untrusted or external SSH servers by enforcing allowlists of permitted SSH endpoints at the firewall or endpoint policy level; this eliminates the attack vector at the cost of reduced operational flexibility. Additionally, user awareness guidance to avoid connecting to unfamiliar or unverified SSH hosts reduces exposure in the interim. Do not rely on SSH host key verification alone as a mitigation - the vulnerability triggers during connection setup before key trust decisions provide protection.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today