CVE-2016-2563: 9bis Kitty

Critical severity, CVSS 9.8. EPSS: 34.2% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.

Affected products

• 9bis Kitty: up to and including 0.66.6.3
• Simon Tatham Putty: up to and including 0.66

Published 2016-04-07. Last modified 2026-06-17.