CVE-2026-102820Medium· 6.2▾ TwilightPoC availablepageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::re…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
Exploit / PoC code exists
0.1% → 0.2%
pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
pageant <= 0.2.2Patched in:
pageant 0.2.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102821Medium· 6.5Russh is a Rust SSH client and server library
CVE-2026-102822Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-102825Low· 3.7Russh is a Rust SSH client and server library
CVE-2026-102823High· 7.5Russh is a Rust SSH client and server library
CVE-2026-102824Medium· 4.3Russh is a Rust SSH client and server library
CVE-2026-111062LowA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request