pageant: Out-of-bounds read in MemoryMap via malicious Pageant agent

The pageant crate contains an out-of-bounds read vulnerability in MemoryMap::read that accepts peer-controlled byte counts without bounds checking. A malicious local process impersonating a Pageant agent can crash russh SSH clients or disclose adjacent process memory.

Disclosed 30 September 2026 · Record updated 1 October 2026

Impact

Denial of service via process crash or excessive memory allocation; potential memory disclosure to adjacent process memory if mapped.

Our coverage

A hand pushing an impossibly long scroll through a tiny window frame, spilling memory like water cascading past broken dam walls into darkness below.

Vulnerabilities

Fake Pageant agent can crash russh SSH clients on Windows

A missing bounds check in the pageant crate lets any local Windows process feed russh an oversized length and read past an 8KB shared memory view.

30 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-g4mp-vgx3-xrvm