What’s Vulnerable › Vulnerabilities

CVE-2016-2563

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 32.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-04-07 · updated 2026-06-17
• Weakness: CWE-119

Description

Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.

Affected products

• 9Bis Kitty: through 0.66.6.3
• Simon Tatham Putty: through 0.66

References

• http://lists.opensuse.org/opensuse-updates/2016-05/msg00131.html
• http://seclists.org/fulldisclosure/2016/Mar/22
• http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html
• http://www.securityfocus.com/bid/84296
• http://www.securitytracker.com/id/1035257
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-2563
• https://security.gentoo.org/glsa/201606-01
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00131.html
• http://seclists.org/fulldisclosure/2016/Mar/22
• http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html
• http://www.securityfocus.com/bid/84296
• http://www.securitytracker.com/id/1035257

Get alerted when CVE-2016-2563 or the next vulnerability affects your stack