CVE-2026-102820: pageant MemoryMap Out-of-Bounds Read Vulnerability
Summary
CVE-2026-102820: MemoryMap::read in the pageant crate (part of the russh workspace, used by russh's SSH-agent client on Windows via AgentClient::connect_pageant) copies a peer-controlled number of bytes out of an 8192-byte shared-memory... Affects pageant versions < 0.2.3. Fixed in 0.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'pageant' crate is part of the russh workspace, providing an SSH-agent client for Windows. It facilitates secure communication by managing SSH keys and agent forwarding. However, it is vulnerable to an out-of-bounds read due to improper handling of peer-controlled data sizes, which can lead to significant security risks.
Vulnerability Detail
The vulnerability lies in the 'MemoryMap::read' function of the 'pageant' crate, which allows a malicious Pageant agent to specify an oversized byte count for reading from a shared memory view. This results in an out-of-bounds read, potentially causing process crashes or disclosing adjacent memory contents. The lack of bounds checking allows attackers to exploit this flaw, leading to denial of service (DoS) and possible information leakage.
How To Fix
Latest published version: 0.2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'pageant' crate until it has been updated to the patched version. Additionally, ensure that only trusted processes can interact with the Pageant agent to mitigate the risk of exploitation.
Conclusion
The 'pageant' crate has a critical vulnerability that allows for out-of-bounds reads due to improper handling of input sizes. It is essential to update to the patched version to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pageant →
FAQ
The CVSS score of this vulnerability is 6.2, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The potential impacts include denial of service (DoS) due to process crashes and possible disclosure of sensitive information from adjacent memory.
While the primary risks are related to availability and confidentiality, there is no direct risk of data loss; however, sensitive information may be exposed.
If you cannot update the package immediately, limit access to the Pageant agent and monitor for any suspicious activity in your application.
