OpenSSH for Windows CVE-2026-69397

The OpenSSH Client optional Windows feature must be installed on the target system (present by default on many Windows 11 and developer-configured Windows 10 installations). A victim user must actively initiate an outbound SSH connection to an attacker-controlled server - passive internet exposure of an SSH server on the victim machine is not an exploitation vector for this vulnerability. The AC:H rating requires precise heap memory conditions or timing to be satisfied, preventing trivially automatable mass exploitation. The attacker requires no credentials or authentication (PR:N). Limiting factors: victim must be directed to connect to a hostile SSH endpoint (social engineering or DNS/BGP redirect required); high complexity limits reliable weaponization; OpenSSH Client must be present as a Windows optional feature; exploitation does not apply to systems where only the OpenSSH Server component is installed without the client.

The 7.5 CVSS base score reflects a real tension between full-compromise impact (C:H/I:H/A:H) and meaningful exploitation constraints (AC:H, UI:R). The AC:H requirement indicates reliable exploitation would demand heap-grooming skill, reducing the likelihood of commoditized mass exploitation. UI:R eliminates any passive server-exposure attack surface - internet-exposed SSH servers running OpenSSH for Windows are NOT directly at risk; the vulnerable party is the client connecting outward to a hostile server. No KEV listing and no public PoC have been identified, keeping near-term real-world exploitation probability low. The 'Denial Of Service' tag in the input data understates the impact class: the CVSS C:H/I:H/A:H metrics confirm this is an RCE-class vulnerability. The wide Windows deployment surface is the primary amplifying factor - millions of developer workstations and server instances run OpenSSH for Windows - but the UI:R gate limits realistic victims to those who can be directed to connect to attacker-controlled SSH infrastructure.

An attacker establishes a malicious SSH server and lures a target user on a vulnerable Windows system - via phishing, a malicious link, or compromised legitimate SSH host reference - into initiating an SSH connection to that server. During SSH handshake negotiation, the crafted server response triggers a use-after-free in the OpenSSH for Windows client, allowing the attacker to reclaim the freed heap block with controlled data and redirect execution to achieve arbitrary code running under the connecting user's security context. No public PoC exists at time of analysis; the AC:H rating suggests exploit development would require non-trivial heap-grooming work.