CVE-2004-1008: Putty

High severity, CVSS 10.0. EPSS: 7.4% chance of exploitation in the next 30 days.

Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute arbitrary code via a SSH2_MSG_DEBUG packet with a modified stringlen parameter, which leads to a buffer overflow.

Affected products

• Putty Putty: version 0.48 only; version 0.49 only; version 0.50 only; version 0.51 only; version 0.52 only; version 0.53 only; …
• Tortoisecvs Tortoisecvs: version 1.8 only

Published 2005-01-10. Last modified 2026-06-16.