---
id: CVE-2026-102820
title: >-
  pageant provides a [PageantStream] type that implements [AsyncRead] and
  [AsyncWrite] traits and can be used to talk to a running Pageant instance
summary: >-
  pageant provides a [PageantStream] type that implements [AsyncRead] and
  [AsyncWrite] traits and can be used to talk to a running Pageant instance.
  Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs
  MemoryMap::re…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-125
  - CWE-789
vendor: Eugeny
product: russh
affected:
  - russh < 0.63.2
  - pageant < 0.2.3
published: '2026-09-29'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T21:17:05.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102820'
references:
  - url: >-
      https://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b
    label: security-advisories@github.com
  - url: 'https://github.com/Eugeny/russh/releases/tag/v0.63.2'
    label: security-advisories@github.com
  - url: 'https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm'
    label: security-advisories@github.com
  - url: 'https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102820.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-102820'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2543500'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-102820'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102820'
  - url: 'https://github.com/advisories/GHSA-g4mp-vgx3-xrvm'
  - url: 'https://github.com/Eugeny/russh'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - ghsa
  - rust
  - osv
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-30T20:11:00.619637Z'
epss: 0.00191
epssPercentile: 0.08663
scores:
  nvd: 6.2
  vendor: 5.5
  ghsa: 6.2
  osv: 6.2
ingestedAt: '2026-09-29T18:42:35.836Z'
aliases:
  - GHSA-g4mp-vgx3-xrvm
ecosystem: rust
patched:
  - pageant 0.2.3
---

## Overview

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-29 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102820.json)

## Package advisory (CVE-2026-102820)

Affected packages:

- `pageant <= 0.2.2`

Patched in:

- `pageant 0.2.3`

Source: https://github.com/advisories/GHSA-g4mp-vgx3-xrvm