{"id":"EUVD-2026-89203","enisaUuid":"9f85d531-3526-3330-aab8-ad488a02e531","description":"pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate\u0027s pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.","datePublished":"Sep 29, 2026, 6:18:43 PM","dateUpdated":"Sep 30, 2026, 8:11:08 PM","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm\nhttps://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.2\n","aliases":"CVE-2026-102820\nGHSA-g4mp-vgx3-xrvm\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"3fee8299-ed51-3f80-9c1a-4a66ab9992ce","product":{"name":"pageant","vendor":{"name":"rust"}},"product_version":"\u003c 0.2.3"},{"id":"59d9c119-d23b-370f-8524-3aae52083a1d","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"\u003c 0.63.2"}],"enisaIdVendor":[{"id":"6e5be974-607a-3482-b3ea-c80868c4dbb6","vendor":{"name":"Eugeny"}},{"id":"8a0010c3-d342-3644-ba57-5021c4800c06","vendor":{"name":"rust"}}],"enisaIdVulnerability":[{"id":"6203be05-54a9-3aa9-b577-9bc972799310","vulnerability":{"id":"CVE-2026-102820","description":"pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate\u0027s pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.","datePublished":"Sep 29, 2026, 6:18:43 PM","dateUpdated":"Sep 30, 2026, 8:11:08 PM","status":"PUBLISHED","baseScore":6.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm\nhttps://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.2\n","enisa_id":"EUVD-2026-89203\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Oct 27, 2026, 7:15:40 AM","vulnerabilityProduct":[{"id":"440249da-7c70-3727-8c52-aded6604066c","product":{"name":"russh","vendor":{"name":"Eugeny"}},"product_version":"\u003c 0.63.2"},{"id":"7b6cebf1-4890-394e-8d03-99904b1b36f9","product":{"name":"pageant","vendor":{"name":"rust"}},"product_version":"\u003c 0.2.3"}],"vulnerabilityVendor":[{"id":"896acbe1-ead1-3506-b84f-a6a9f85673c8","vendor":{"name":"Eugeny"}},{"id":"e64c1ccc-9b9b-3f3e-a7fb-3f3dda913cab","vendor":{"name":"rust"}}]}},{"id":"b2847e56-74e0-307e-9366-d35924b2993c","vulnerability":{"id":"GHSA-g4mp-vgx3-xrvm","description":"pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)","datePublished":"Sep 30, 2026, 11:41:02 PM","dateUpdated":"Sep 30, 2026, 11:41:03 PM","baseScore":0.0,"references":"https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102820\nhttps://github.com/Eugeny/russh/commit/5d566989ebabfdebfe6b33243d31765a0812260b\nhttps://github.com/Eugeny/russh\nhttps://github.com/Eugeny/russh/releases/tag/v0.63.2\n","enisa_id":"EUVD-2026-89203\n","aliases":"GHSA-g4mp-vgx3-xrvm\nCVE-2026-102820\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}