CVE-2026-48850

EUVD-2026-31729
PuTTY 0.72 before 0.84 has a double free in RSA KEX.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.7 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Affected Products (NVD)
VendorProductVersion
puttyputty
0.72 ≤
𝑥
< 0.84
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
putty
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
forky
0.84-1
fixed
sid
0.84-1
fixed
trixie
no-dsa
Common Weakness Enumeration
References
https://lists.tartarus.org/pipermail/putty-announce/2026/000042.html
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/rsakex-double-free.html