CVE-2026-102820: eugeny russh Out-of-bounds Read

Vulnerability summary

CVE-2026-102820 is a medium (CVSS 6.2) Out-of-bounds Read vulnerability in eugeny russh. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.2% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 30-09-2026
   Last modifiedVulnerability information updated.

Description

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.