CVE-2026-102820

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-102820

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102820.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-102820

Aliases

GHSA-g4mp-vgx3-xrvm

Published

2026-09-29T18:18:43Z

Modified

2026-09-30T03:47:23Z

Severity

6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Details

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125",
        "CWE-789"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102820.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "0.2.3"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/eugeny/russh

Affected ranges

Type

GIT

Repo

https://github.com/eugeny/russh

Events

Introduced

Fixed

8a51a0dca4f6fbdcc3ce98c627254026b25b3252

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.63.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.37.0-beta.1

v0.*

v0.34.0

v0.35.0-beta.1

v0.35.0-beta.2

v0.35.0-beta.3

v0.35.0-beta.5

v0.35.0-beta.6

v0.35.0-beta.7

v0.35.0-beta.8

v0.35.0-beta.9

v0.36.1

v0.37.0

v0.37.0-beta.1

v0.37.1

v0.38.0

v0.38.0-beta.1

v0.39.0-beta.1

v0.40.0

v0.40.1

v0.40.2

v0.42.0

v0.43.0

v0.43.0-beta.1

v0.44.0

v0.44.0-beta.1

v0.44.0-beta.3

v0.44.0-beta.4

v0.45.0

v0.46.0

v0.47.0-beta.3

v0.47.0-beta.4

v0.48.0

v0.48.1

v0.48.2

v0.49.0

v0.50.0

v0.50.0-beta.10

v0.50.0-beta.11

v0.50.0-beta.12

v0.50.0-beta.2

v0.50.0-beta.3

v0.50.0-beta.4

v0.50.0-beta.5

v0.50.0-beta.6

v0.50.0-beta.7

v0.50.0-beta.8

v0.50.0-beta.9

v0.50.1

v0.50.3

v0.50.4

v0.51.0

v0.51.0-beta.1

v0.51.0-beta.2

v0.51.0-beta.3

v0.51.1

v0.52.0

v0.52.0-beta.1

v0.52.1

v0.53.0

v0.53.0-beta.1

v0.54.0

v0.54.1

v0.54.2

v0.54.3

v0.54.4

v0.54.5

v0.54.6

v0.55.0

v0.56.0

v0.57.0

v0.57.1

v0.58.0

v0.59.0

v0.60.0

v0.60.1

v0.60.2

v0.60.3

v0.61.0

v0.61.1

v0.61.2

v0.62.0

v0.62.1

v0.62.2

v0.62.3

v0.62.4

v0.62.5

v0.62.6

v0.62.7

v0.63.0

v0.63.0-beta.1

v0.63.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102820.json"