No access to your tenant or devices. Every item links to its source. What this means
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Eugeny",
"product": "russh",
"versions": [
{
"version": "< 0.63.2",
"status": "affected"
}
]
}Vendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "rust",
"product": "pageant",
"versions": [
{
"version": "< 0.2.3",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON