pageant (russh) EUVD-2026-111390

Exploitation requires an application that bridges an SSH forwarded-agent channel directly to the raw pageant::PageantStream (the documented transport-only usage, e.g. copy_bidirectional between the SSH server channel and PageantStream), so that the peer-controlled channel payload supplies the trusted 4-byte length prefix read in PageantStream::new (wmmessage.rs). The attacker must control or have compromised the upstream SSH server the client connects to. Platform is limited to Windows (the WM_COPYDATA / _AGENT_MAX_MSGLEN shared-memory transport) and to pageant versions 0.2.0 through 0.2.4. Exploitation does NOT apply to russh's typed AgentClient path, which bounds response frames at 256 KiB; only the raw-stream bridging pattern is affected. The only complete fix stated by the vendor is upgrading to pageant 0.2.5, which rejects frames exceeding _AGENT_MAX_MSGLEN before buffering.

All signals converge on LOW real-world priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, VA:L only, VC:N/VI:N) scores 2.3, and the vuln.today Decision label is 'monitor' - not act_now or emergency. The impact ceiling is a memory-exhaustion DoS of the client process (CWE-770): no confidentiality or integrity impact, no code execution, no memory-safety violation (the advisory states this explicitly). A working proof-of-concept is published in the GHSA advisory, so exploit code is public, but a public PoC is a distinct signal from active exploitation: this CVE is NOT in CISA KEV, so there is no confirmed in-the-wild use. No EPSS score was provided in the input, so exploitation-probability cannot be compared against the KEV/PoC signals - that data is MISSING. Two attack-requirement signals materially cap risk: AT:P (a specific condition must hold) and UI:P (the vulnerable bridging usage), both reflecting that exploitation only applies when an application bridges an SSH forwarded-agent channel directly to the raw PageantStream and the attacker controls the upstream SSH server. The crate's own typed AgentClient path is not affected (it bounds frames at MAX_AGENT_FRAME_LEN / 256 KiB). Net: a genuine but low-severity, deployment-dependent DoS - patch in normal maintenance cadence, not an emergency.

A Windows SSH client built on russh/pageant 0.2.0-0.2.4 services a remote server's forwarded-agent channel by bridging the SSH channel bytes directly into a raw PageantStream (e.g. tokio::io::copy_bidirectional). A malicious or compromised SSH server sends the 4-byte big-endian prefix FF FF F0 00 claiming a ~4 GiB frame, then streams data or simply stalls mid-frame, forcing the client's re-framing task to buffer unbounded memory. A working PoC is published in the GHSA advisory: observed working-set growth from ~7.4 MB to ~264.7 MB after streaming 256 MiB, with memory retained while the peer stalls.