Vulnerability · Published Sep 29, 2026 · Assigned by GitHub_M

CVE-2026-102820pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Medium 6.2

In plain English

A medium-severity out-of-bounds read in russh from Eugeny. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	rust-russh	0.64.1-1	DEBIAN-CVE-2026-102820
Ubuntu:26.10	rust-russh	no fix listed	UBUNTU-CVE-2026-102820

Affected products (as reported)

Vendor	Product	Versions
Eugeny	russh	< 0.63.2
rust	pageant	< 0.2.3

Weakness: CWE-125, CWE-789 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm x_refsource_CONFIRM
https://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b x_refsource_MISC
https://github.com/Eugeny/russh/releases/tag/v0.63.2 x_refsource_MISC