PuTTY versions 0.77 through 0.83 use an icon copy as a visual indicator of trust for Telnet traffic, but the trust state is not reset after a proxy authentication step. The bug means that Telnet data following proxy login may erroneously retain a trusted flag, potentially allowing an attacker to influence the client with data presumed trustworthy. The effect is limited to integrity and confidentiality of session data, and is reflected in the low CVSS score of 3.1.

All users of PuTTY 0.77, 0.78, 0.79, 0.80, 0.81, 0.82, and 0.83 are impacted. The fix begins in release 0.84 and later.

The vulnerability scores a CVSS of 3.1 and has no EPSS data available; it is not listed in the CISA KEV catalog. Because the flaw is an internal trust flag that is not cleared, it would require an attacker to successfully manipulate a proxy session that then passes unverified Telnet data to the client. The current likelihood of exploitation is low, and the potential impact is moderate, with no known widespread active exploitation.