What is the CVSS score of EUVD-2026-31731?

EUVD-2026-31731 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31731?

Yes, a patch is available for EUVD-2026-31731. Update the affected software to the latest version immediately.

PuTTY EUVD-2026-31731

| CVE-2026-48851 LOW

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-05-25 mitre

GHSA-5fwp-h8j4-xmhm

Information Disclosure Putty

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:34 vuln.today

Patch available

May 26, 2026 - 14:01 EUVD

DescriptionCVE.org

PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxy authentication and the main session.

AnalysisAI

PuTTY's trust sigil mechanism - the application icon displayed to distinguish legitimate remote TELNET output from locally-injected spoofed content - fails to reset trust state between proxy authentication and the start of the main TELNET session in versions 0.77 through 0.83. Under CWE-451 (UI Misrepresentation of Critical Information), an attacker positioned to control or influence a TELNET proxy could present deceptive terminal content to the user bearing the trusted indicator, achieving low-integrity impact by misleading the user about the source or authenticity of displayed data. No public exploit exists, EPSS is 0.03% (9th percentile), CISA SSVC rates exploitation as none, and the overall CVSS score is 3.1 (Low), reflecting high attack complexity and narrow real-world applicability.

Technical ContextAI

PuTTY's trust sigil is a visual security mechanism - the PuTTY window icon is used to mark terminal lines as originating from a trusted remote host, helping users distinguish legitimate host output from spoofed content injected by a local process or intermediary. This feature is specific to TELNET connections, where no cryptographic channel authentication exists. The root cause (CWE-451) is a state management failure: the trust status accumulated during proxy authentication is not cleared before the main TELNET session begins, allowing trust state to bleed across the authentication boundary. The affected CPE is cpe:2.3:a:putty:putty:*:*:*:*:*:*:*:* covering the PuTTY SSH/TELNET client by Simon Tatham. The vulnerability is documented in the upstream wishlist entry at https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/telnet-trust-sigil.html.

RemediationAI

Upgrade to PuTTY 0.84 or later, which resolves the trust-sigil state management flaw between proxy authentication and the main TELNET session. The vendor release announcement is available at https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html. As a compensating control for environments that cannot immediately upgrade, disable TELNET proxy authentication workflows in PuTTY or migrate TELNET-dependent connections to SSH where cryptographic session separation makes this class of trust-sigil attack irrelevant. Blocking outbound TELNET (TCP port 23) at the perimeter also eliminates the attack surface entirely, though this may impact legacy systems dependent on TELNET. Given the low severity and narrow applicability, patch deployment can be prioritized alongside routine maintenance cycles rather than emergency response.