PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification. (CVE-2026-48852)
Description
PuTTY versions 0.71 through 0.83-3build1 have an assertion failure vulnerability in ECDSA signature verification. This flaw can cause the application to crash, resulting in a denial of service. The vulnerability has a medium severity rating with a CVSS score of 3.7. No known exploits are reported in the wild. The issue affects multiple specific versions prior to 0.84.
CVSS v3.1
Score 3.7low
Affected software
pkg:deb/ubuntu/putty?arch=source&distro=xenialpkg:deb/ubuntu/putty?arch=source&distro=bionicpkg:deb/ubuntu/putty?arch=source&distro=focalpkg:deb/ubuntu/putty?arch=source&distro=jammypkg:deb/ubuntu/putty?arch=source&distro=noblepkg:deb/ubuntu/putty?arch=source&distro=questingpkg:deb/ubuntu/putty?arch=source&distro=stonkingpkg:deb/ubuntu/putty?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
PuTTY versions from 0.71 up to but not including 0.84 contain an assertion failure in the ECDSA signature verification process. This vulnerability can lead to application crashes, impacting availability. The CVSS 3.1 base score is 3.7, reflecting a network attack vector with high attack complexity, no privileges required, no user interaction, and an impact limited to availability loss. There is no indication of confidentiality or integrity impact. No exploits are known to be active in the wild.
Potential Impact
The vulnerability causes an assertion failure during ECDSA signature verification, which may crash the PuTTY client and cause a denial of service. There is no reported impact on confidentiality or integrity. The medium severity rating reflects the limited scope of the impact to availability only.
Mitigation Recommendations
No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official PuTTY releases for updates addressing this issue and consider upgrading to version 0.84 or later once confirmed fixed.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-48852
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f61d2cdf04f65666419e
Added to database: 10/17/2026, 22:26:37 UTC
Last enriched: 10/18/2026, 01:05:07 UTC
Last updated: 10/18/2026, 01:05:07 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.