Bug 2481291 (CVE-2026-48850)

A flaw was found in PuTTY. The implementation of the little-used RSA kex exchange method (RFC 4432) has a double-free issue. In some situations it frees an RSA key by calling the special-purpose function ssh_rsakex_freekey and then also calling the normal free function on the outermost struct, which is wrong, because ssh_rsakex_freekey already freed the whole struct. This bug does not happen if RSA kex completes normally. The double-free only occurs on an error handling path, triggered if the key sent by the server is unexpectedly short. This bug allows a server to provoke the double-free on purpose, because it can present only RSA kex as an option in its KEXINIT, and then deliberately send a short key. Since it happens before host key verification, a MITM can do the same. Therefore, this bug is listed as a vulnerability, since it's a remote-triggerable crash. However, we don't know of any way in which the double-free can be exploited to achieve a controllable effect.