CVE-2026-102820 · GHSA-g4mp-vgx3-xrvm

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Risk score: 43/100
CVSS: 6.2 v3.1
Exploit chance (30 days): 0.1%
Published: 29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192…
Affected: pageant (rust) <= 0.2.2
Fix: Upgrade pageant to 0.2.3 or later.
Exploitation: Public proof of concept

Why it is Yellow

CVSS 6.2 medium
Public exploit or proof of concept referenced

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
pageant	rust	<= 0.2.2	0.2.3

References

Original description

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 response length supplied through the 8192-byte Pageant shared-memory mapping reached by AgentClient::connect_pageant. A local process that impersonates the Pageant window can make query_pageant_direct allocate up to approximately 4 GiB and copy beyond the mapped view, reliably crashing a russh client and conditionally exposing adjacent committed memory. This issue is fixed in pageant 0.2.3.

Last activity 29 Sep 2026. Patch Forecast updates every hour.