Memory Exhaustion Vulnerability in Pageant by Eugeny

CVE-2026-116775

What is CVE-2026-116775?

The vulnerability in Pageant allows an attacker to exploit the PageantStream implementation between versions 0.2.0 and 0.2.5, which improperly manages peer-controlled length prefixes. This oversight enables a malicious server to manipulate communication, potentially leading to significant memory exhaustion in the client by forcing excessive memory allocations. The issue arises from buffering behavior that does not respect predefined transport capacity limits. Update to version 0.2.5 or later to mitigate the risk.

References