CVE-2016-2563

—

CVSS 3.0

9.8 critical

EPSS

34%p98

Published

Apr 7, 2016 (Apr 7, 2016)

Modified

Jun 17, 2026

Description

Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.

Vendors: 9bis simon tatham
Products: kitty, putty
Weakness: CWE-119
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (34.2%)

In the news0 stories

No ingested article mentions this CVE yet.