This vulnerability affects PuTTY 0.83 and is caused by improper verification of cryptographic signatures in the Ed25519 signature handler, specifically in the eddsa_verify function. This flaw could potentially allow an attacker to bypass signature verification under complex attack conditions. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity), indicating network attack vector with high complexity and limited impact. The vendor responded promptly and released a patch identified by commit af996b5ec27ab79bae3882071b9d6acf16044549. No known exploits have been observed in the wild, and the real-world impact remains uncertain.

The vulnerability could allow an attacker to bypass cryptographic signature verification remotely, potentially undermining the integrity of cryptographic operations in PuTTY. However, exploitation is difficult due to the high complexity required, and no known active exploitation has been reported. The real-world impact of this flaw is currently unproven.

An official patch is available and should be applied to affected PuTTY installations (version 0.83) to remediate this vulnerability. Since the vendor has released a fix and no active exploitation is known, applying the patch is the recommended course of action.