CVE-2016-2563: 9bis kitty
Vulnerability summary
CVE-2016-2563 is a critical (CVSS 9.8) vulnerability in 9bis kitty. EPSS estimates a 32.80% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (exploit-database, 10-03-2016)
Source freshness unavailable
How is this decided?Timeline
- 07-04-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
32.80%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
Decrease -1.41 pp
From 34.22% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPutty pscp 0.66 - Stack Buffer Overwrite
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Mageia5 products
- filezilla< 3.16.1-1.mga5
- halibut< 1.1-2.mga5
- libfilezilla< 0.4.0.1-1.mga5
- pugixml< 1.7-1.mga5
- putty< 0.67-1.mga5
9bis1 product
- kitty≤ 0.66.6.3
Debian1 product
- putty< 0.67-1
Simon_tatham1 product
- putty≤ 0.66
Ubuntu1 product
- putty< 0.67-1
5 vendors · 9 products
References
17 links- www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.htmlX Refsource CONFIRMPatchWEBREPORT
