Tera Term TTSSH2 EUVD-2026-45140

The victim must actively initiate an SSH connection from Tera Term (with TTSSH2 plugin active) to an SSH server controlled by the attacker - CVSS UI:R confirms this required user interaction. The attacker must operate or control a reachable SSH endpoint. No authentication or elevated privileges are required on the attacker side. Exploitation is limited to Windows systems running Tera Term with TTSSH2; users who do not use Tera Term for SSH, or who use an alternative SSH client, are not affected. The vulnerability is triggered during the connection establishment phase, so the victim does not need to authenticate to the malicious server.

The CVSS 3.0 base score of 6.3 (Medium) reflects a network-reachable flaw requiring no attacker privileges (PR:N, AV:N, AC:L) but mandating user interaction (UI:R), which is the primary real-world limiting factor. Exploitation requires the victim to actively initiate an SSH session toward an attacker-controlled server, making this a client-side vulnerability rather than a server-side one - the attack surface is users who connect to untrusted SSH endpoints. Confidentiality, integrity, and availability impacts are all rated Low, consistent with partial memory disclosure and the possibility of a crash rather than full code execution. No EPSS data was provided in the input; no CISA KEV listing exists; no public exploit code has been identified. The absence of a KEV listing and POC availability suggests this has not been actively exploited at scale. The realistic threat scenario involves targeted social engineering (phishing a link or hostname) rather than mass exploitation. The tags include 'Buffer Overflow,' which aligns with the OOB write component but the CVSS impact scores suggest constrained blast radius.

An attacker stands up a malicious SSH server and delivers its hostname or IP to a target via phishing, a compromised jump-host list, or a fraudulent IT support message. When the victim opens Tera Term and connects to the server, the TTSSH2 handshake parsing triggers the integer conversion error, causing it to read beyond the intended buffer and transmit a slice of heap or stack memory back to the attacker's server, potentially containing credentials, session keys, or other sensitive data resident in the process at connection time. The client may also crash immediately after, leaving forensic indicators but no persistent access.