CVE-2026-58317

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-17 · updated 2026-10-24
Weakness: CWE-196

Description

Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.

Affected products

TeraTerm Project TTSSH2: from 1.00 alpha1 through 3.6.1

References

https://jvn.jp/en/jp/JVN65294474/
https://teratermproject.github.io/SA/JVN65294474-en.html
https://teratermproject.github.io/SA/JVN65294474.html

Get alerted when CVE-2026-58317 or the next vulnerability affects your stack