Pageant
Monthly
The Windows Pageant client inside the pageant Rust crate (pageant/src/wmmessage.rs) trusts a peer-controlled u32 response length read from the 8192-byte Pageant shared-memory mapping, so a local process that impersonates the Pageant window can drive MemoryMap::read to allocate up to roughly 4 GiB and copy past the end of the mapped view. In practice this reliably crashes a russh-based SSH client that queries the agent via AgentClient::connect_pageant, and can conditionally expose adjacent committed memory. The issue is fixed in pageant 0.2.3 (russh v0.63.2); exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2), with no CISA KEV entry and no public exploit identified at time of analysis.
The Windows Pageant client inside the pageant Rust crate (pageant/src/wmmessage.rs) trusts a peer-controlled u32 response length read from the 8192-byte Pageant shared-memory mapping, so a local process that impersonates the Pageant window can drive MemoryMap::read to allocate up to roughly 4 GiB and copy past the end of the mapped view. In practice this reliably crashes a russh-based SSH client that queries the agent via AgentClient::connect_pageant, and can conditionally expose adjacent committed memory. The issue is fixed in pageant 0.2.3 (russh v0.63.2); exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2), with no CISA KEV entry and no public exploit identified at time of analysis.