The vulnerability CVE-2026-58317 in the TTSSH2 plugin of Tera Term arises from an unsigned to signed conversion error (CWE-196). When Tera Term attempts to connect via SSH to a server controlled by an attacker, this error can trigger out-of-bounds memory read/write operations. Consequently, data from adjacent memory regions may be transmitted to the attacker, and the application may terminate abnormally or behave unexpectedly. The CVSS 3.0 base score is 6.3, indicating medium severity. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of adjacent memory contents to an attacker and cause application instability or crash. The confidentiality, integrity, and availability of the Tera Term client may be partially impacted due to information leakage and abnormal termination.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when connecting to untrusted SSH servers. Monitor vendor communications for updates regarding patches or mitigations.