EUVD-2026-73693
GHSA-7p96-34g5-jqvf
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable SSH client UAF exploited via malicious server requires victim to initiate connection (UI:R) and precise heap conditions (AC:H); attacker needs no credentials (PR:N); full CIA impact on exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
AnalysisAI
Use-after-free in Microsoft's OpenSSH for Windows enables unauthenticated network attackers to achieve remote code execution across a broad range of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation is constrained by high attack complexity and a requirement for user interaction, consistent with a client-side attack path where a victim must connect to an attacker-controlled SSH endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The OpenSSH Client optional Windows feature must be installed on the target system (present by default on many Windows 11 and developer-configured Windows 10 installations). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The 7.5 CVSS base score reflects a real tension between full-compromise impact (C:H/I:H/A:H) and meaningful exploitation constraints (AC:H, UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's security updates via Windows Update, WSUS, or SCCM targeting the applicable Windows release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server systems with OpenSSH installed to establish your organization's exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today