CVE-2026-48852 Details

An assertion failure vulnerability has been identified in PuTTY versions 0.71 prior to 0.84, during the ECDSA signature verification process. This vulnerability allows a malicious server or a man-in-the-middle attacker to cause PuTTY to crash by sending carefully crafted host keys and signatures during the initial SSH key exchange. The issue arises from an improper assertion in the elliptic curve arithmetic, which incorrectly treats the addition of two points with the same y-coordinate as an error, leading to a denial-of-service condition by causing the application to crash.

Users can upgrade to PuTTY version 0.84 or later, where this vulnerability has been fixed.